CVE-2026-104627
The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.
- CVSS 3.1
- 5.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 1% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-287, CWE-352
- Published
- Modified
- Record from
- the NVD, synced