CVE-2026-73278

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Gitea Limited

Description

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-73278

EUVD

EUVD-2026-93940

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	From 1.16.0 (inc) to 1.27.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the only configured second factor. This allows an attacker who can authenticate via an external identity flow to gain a full session without verifying the passkey, which would normally be required during password login.

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running a vulnerable version (1.16.0 to 1.27.1). Verify if WebAuthn is the only second factor configured for accounts. Inspect OAuth2 and OpenID Connect sign-in logs for sessions established without WebAuthn challenges. Commands like 'gitea version' or checking the admin panel for version info can help identify affected instances.

Impact Analysis

An attacker could exploit this to bypass WebAuthn authentication and gain unauthorized access to your Gitea account. If an external identity link is created, the compromise could persist even after the initial session ends.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it relates to authentication bypass in Gitea's OAuth2 and OpenID Connect flows. However, unauthorized access due to missing WebAuthn challenges could lead to data breaches, which may violate GDPR's integrity and confidentiality principles or HIPAA's access controls.

Mitigation Strategies

Enable additional second factors like TOTP alongside WebAuthn to ensure multi-factor authentication is enforced. Review OAuth2 and OpenID Connect sign-in paths for exposed or misconfigured external identity flows.

Hi! I’m here to help you understand CVE-2026-73278. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70