CVE-2026-120263
Deferred Deferred - Pending Action

OAuth2 Account Linking Authentication Bypass in Gitea

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Gitea Limited

Description
When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the OAuth2 provider. An attacker with an account on a configured OAuth2 provider could submit another user's name, link their external identity to that Gitea account and be signed in as it without its password, including as an administrator. The link persisted for later sign-ins. Automatic linking now only happens when the existing account matches the provider's email or provider-derived user name; otherwise the account password is required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120263

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Gitea occurs when the OAuth2 setting ACCOUNT_LINKING is set to auto (not default) and registration is enabled. An attacker with an OAuth2 account can submit another user's username or email in the sign-up form. The system incorrectly links the attacker's external identity to the victim's account without verifying ownership, allowing unauthorized access including admin accounts. The link persists for future logins.

Detection Guidance

To detect this vulnerability, check if Gitea is configured with `[oauth2_client].ACCOUNT_LINKING = auto` in its configuration file. Review logs for suspicious account linking attempts where an attacker might have submitted another user's username or email during OAuth2 registration. Look for failed login attempts or unexpected account access patterns.

Impact Analysis

An attacker could gain full access to your Gitea account without knowing your password, including admin accounts. They can enumerate users, access repositories, and potentially execute remote code via git hooks. The attack persists even if you have WebAuthn 2FA configured, as it bypasses TOTP-only checks. Your account remains compromised until the issue is patched.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data stored in Gitea repositories, violating confidentiality requirements in GDPR and HIPAA. Organizations using Gitea with OAuth2 auto-linking may face compliance violations due to potential data breaches and unauthorized access to protected health or personal information.

Mitigation Strategies

Disable the auto account linking feature by setting [oauth2_client].ACCOUNT_LINKING to a value other than auto in Gitea's configuration. Ensure that automatic linking only occurs when the existing user's email matches the provider's email or when the username derived from the provider matches the existing user's name. Require password verification for any account linking attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120263. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...