CVE-2026-73535

Deferred Deferred - Pending Action

Gitea OpenID Session Hijack via Missing TOTP/WebAuthn Verification

Publication date: 2026-10-14

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-73535

EUVD

EUVD-2026-101104

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-696	The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.
CWE-304	The product implements an authentication technique, but it skips a step that weakens the technique.

Attack-Flow Graph

Executive Summary

CVE-2026-73535 is a high-severity vulnerability in Gitea versions 1.27.1 and earlier. It allows attackers to bypass two-factor authentication (2FA) and achieve persistent account takeover through OpenID identity linking. The issue occurs in the OpenID connect handler, which fails to enforce second-factor authentication during the OpenID connect flow.

Detection Guidance

Check Gitea version with: curl -s http://your-gitea-server/api/v1/version | grep version. If version is 1.27.1 or earlier, the system is vulnerable. Inspect OpenID connect handler logs for unusual sign-in attempts bypassing 2FA.

Impact Analysis

An attacker who knows a victim's password can exploit this by submitting the password via OpenID instead of the normal login form, bypassing TOTP and WebAuthn checks entirely. The attacker can attach a malicious OpenID identifier to the victim's account before sign-in completes. Even if the victim changes their password, the linked identifier remains active, granting the attacker persistent access to repositories, CI secrets, Actions configurations, and push permissions.

Compliance Impact

This vulnerability allows attackers to bypass two-factor authentication and gain persistent access to user accounts, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by enabling unauthorized access to personal or protected health information.

Mitigation Strategies

Upgrade Gitea to version 1.27.2 or later immediately. Disable OpenID connect sign-in if not required. Review accounts for unauthorized OpenID identifier links and revoke any suspicious sessions.

Hi! I’m here to help you understand CVE-2026-73535. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70