{"id":"CVE-2026-104627","published":"2026-10-18T19:16:32.463","lastModified":"2026-10-19T21:17:03.083","description":"The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cwes":["CWE-287","CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-28.2.0/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39642","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39744","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.2.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-mf69-7pqq-86vx","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/39642","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39744","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.2.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-mf69-7pqq-86vx","tags":[]}],"hasPoc":true,"ai":null}