CVE-2026-78231

Deferred Deferred - Pending Action

Blind SSRF in Gitea via OpenID Provider Interaction

Publication date: 2026-10-14

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services reachable from the Gitea server. The response is not returned to the attacker, so the issue is blind SSRF; its impact depends on the services and network addresses the server can reach.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-78231

EUVD

EUVD-2026-101110

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-78231 is an unauthenticated Blind Server-Side Request Forgery (SSRF) in Gitea affecting versions up to 1.26.4. When OpenID sign-in is enabled, an attacker can send an unauthenticated GET request to /user/login/openid, which causes the Gitea server to make an outbound HTTP POST request to an attacker-controlled URL specified via the openid.op_endpoint parameter.

Detection Guidance

To detect this vulnerability, monitor outbound HTTP POST requests from your Gitea server, especially those targeting internal or unexpected endpoints. Check logs for requests to `/user/login/openid` with the `openid.op_endpoint` parameter pointing to external or internal URLs. Use network traffic analysis tools like tcpdump or Wireshark to inspect outbound connections from the Gitea server.

Impact Analysis

This vulnerability allows an attacker to interact with internal services reachable by the Gitea server, such as loopback interfaces, private networks, or internal APIs. It could lead to unauthorized actions on internal services or potential availability issues if the server sends requests to slow or unresponsive targets.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling unauthorized interactions with internal services. For GDPR, unauthorized access to internal systems might lead to data exposure or processing violations. For HIPAA, exposure of internal APIs or services could risk protected health information. The blind SSRF allows attackers to probe internal networks, potentially accessing sensitive data or systems.

Mitigation Strategies

Immediately upgrade Gitea to version 1.27.0 or later to patch the vulnerability. If upgrading is not immediately possible, disable OpenID sign-in in Gitea configuration to prevent the vulnerable endpoint from being accessible. Review and restrict network access for the Gitea server to limit potential impact from SSRF attacks.

Hi! I’m here to help you understand CVE-2026-78231. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70