{"id":"CVE-2026-73278","published":"2026-10-06T20:17:29.000","lastModified":"2026-10-07T21:17:16.827","description":"Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-1.27.2/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/38805","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/38810","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.2","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-92j2-6qcg-c28c","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/38805","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/38810","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.2","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-92j2-6qcg-c28c","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an attacker to bypass passkey verification during OAuth2 and OpenID Connect sign-in, gaining full session access. This is critical as it undermines multi-factor authentication (MFA) and can lead to full account compromise.","exploitability":"Exploitation is relatively straightforward for an attacker who can authenticate through the affected external identity flow. The precondition is that WebAuthn is the only configured second factor.","blast_radius":"If exploited, the compromise can extend beyond the initial session, potentially leading to full account takeover and data exfiltration.","remediation":"Disable the affected OAuth2 and OpenID Connect sign-in paths until a patch is available or upgrade to the latest version of Gitea.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","mfa","gitea"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-08T08:40:39.297Z"}}