CVE-2026-23603
Received Received - Intake

Blind SSRF via Unvalidated OIDC Picture Claim in OAuth2

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-23603
EUVD
EUVD-2026-58134

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
go-gitea gitea to 1.26.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-23603 is a Blind Server-Side Request Forgery (SSRF) vulnerability in Gitea affecting versions 1.26.4 and earlier. It occurs when OAuth2 avatar synchronization is enabled, causing Gitea to fetch avatar URLs from OAuth2/OIDC providers without validating the destination host or IP. An attacker can manipulate their OIDC picture claim to force the server to make arbitrary outbound HTTP GET requests to internal or external addresses.

Detection Guidance

Check if OAuth2 avatar synchronization is enabled by verifying the Gitea configuration file for UPDATE_AVATAR=true. Inspect network logs for outbound HTTP GET requests from the Gitea server to unusual or internal addresses, especially during avatar synchronization.

Impact Analysis

This vulnerability allows an attacker with low privileges to make the Gitea server send HTTP requests to arbitrary internal or external addresses. While responses are typically rejected if not images, certain deployments might store valid image responses from internal services as the attacker's avatar, enabling limited data retrieval. The impact includes potential exposure of internal services or data.

Mitigation Strategies

Disable OAuth2 avatar synchronization by setting UPDATE_AVATAR=false in the Gitea configuration. Update Gitea to a version later than 1.26.4 if available. Restrict outbound network access from the Gitea server to prevent unauthorized requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23603. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart