CVE-2026-104627

Received Received - Intake

OpenID Association Spoofing in Gitea

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-104627

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves Gitea's OpenID association callback in security settings. It accepted a positive OpenID 2.0 assertion without verifying if the user initiated the linking process. Attackers could exploit unsolicited OpenID assertions to attach their identity to a victim's account via a crafted link. The victim would then be logged in as the attacker through OpenID, bypassing local TOTP or WebAuthn checks. The fix requires a time-limited state value bound to the user.

Detection Guidance

This vulnerability involves OpenID association callback handling in Gitea. Detection requires checking Gitea logs for unexpected OpenID callback events without a valid state parameter or user-initiated linking. Review logs for OpenID assertions from unsolicited providers or mismatched user identities.

Impact Analysis

If you use Gitea with OpenID login, an attacker could trick you into clicking a malicious link. This could allow the attacker to gain access to your account, bypassing additional security measures like TOTP or WebAuthn. Your account could then be used by the attacker to perform unauthorized actions.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized account access through OpenID manipulation. If exploited, it may lead to unauthorized data exposure or modification, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Update Gitea to the latest version to ensure the OpenID association callback requires a time-limited state value bound to the user. Review OpenID provider configurations to prevent unsolicited assertions.

Hi! I’m here to help you understand CVE-2026-104627. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70