CVE-2026-73535

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-25)

CWEs

CWE-304, CWE-696

Published

2026-10-14

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

References

• https://blog.gitea.com/release-of-1.27.2/
• https://github.com/go-gitea/gitea/pull/38805
• https://github.com/go-gitea/gitea/pull/38810
• https://github.com/go-gitea/gitea/releases/tag/v1.27.2
• https://github.com/go-gitea/gitea/security/advisories/GHSA-8xjr-x7rg-hp5h

Check your stackJSON