{"id":"CVE-2026-104627","kind":"vulnerability","aliases":["CVE-2026-104627"],"related":[],"title":"Gitea: OpenID linking callback lets an attacker take over a signed-in account","description":"The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.","summary":"Gitea's OpenID 2.0 account-linking callback accepted assertions that the signed-in user never started, so an attacker-controlled OpenID provider could attach its identity to a victim's account. The attacker could then log in as the victim through OpenID, which skips the local TOTP and WebAuthn checks.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gitea","openid","other","self-hosted"],"not_affected_if":["no-openid-linking","openid-disabled"],"how_to_check":"- Check the Gitea version with `gitea --version` or the footer of the web UI, and compare against the fixed release in the advisory (unknown in sources).\n- Check whether OpenID sign-in is enabled under the Gitea admin settings (unknown in sources whether it is on by default).","fix":"- Upgrade Gitea to a release that includes the fix; the fixed version is unknown in the sources.\n- Until upgraded, disable OpenID sign-in or OpenID account linking in the Gitea settings.","status":"open","published_at":"2026-10-18T19:16:32+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:16:52+00:00","updated_at":"2026-10-25T04:16:52+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T04:16:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Gitea to a release that includes the fix; the fixed version is unknown in the sources.\n- Until upgraded, disable OpenID sign-in or OpenID account linking in the Gitea settings.","reach":"internet","title":"Gitea: OpenID linking callback lets an attacker take over a signed-in account","impact":"high","summary":"Gitea's OpenID 2.0 account-linking callback accepted assertions that the signed-in user never started, so an attacker-controlled OpenID provider could attach its identity to a victim's account. The attacker could then log in as the victim through OpenID, which skips the local TOTP and WebAuthn checks.","category":"other","nicknames":[],"who_cares":["gitea","self-hosted","openid"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker logs in as victim, bypassing TOTP and WebAuthn checks.","analyst_note":"Confirm the fixed Gitea version and whether OpenID is enabled by default, using the NVD entry and the Gitea release notes.","how_to_check":"- Check the Gitea version with `gitea --version` or the footer of the web UI, and compare against the fixed release in the advisory (unknown in sources).\n- Check whether OpenID sign-in is enabled under the Gitea admin settings (unknown in sources whether it is on by default).","needs_analyst":true,"not_affected_if":["openid-disabled","no-openid-linking"],"who_is_affected":"Instances that allow OpenID 2.0 sign-in or linking of OpenID identities to local accounts are exposed, since the flaw sits in the security settings callback. Instances that do not use OpenID can skip it. Whether the default configuration enables OpenID is unknown in the sources.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000662,"input_tokens":3397,"output_tokens":644,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104627':17A,20A '-2026':16A,19A '2.0':30B,93C,109C 'accept':35B,89C 'account':14A,32B,60B,127C 'account-link':31B 'allow':110C 'appli':155C 'assert':36B,94C,112C 'associ':83C 'attach':53B,120C 'attack':7A,48B,62B,115C,122C,141C 'attacker-control':47B,114C 'bound':172C 'callback':4A,34B,84C,163C 'check':79B,96C,161C 'control':49B,116C 'could':52B,63B,119C,142C 'craft':137C 'cve':15A,18A 'gitea':1A,21B,27B,81C 'host':26B 'ident':55B,124C 'let':5A 'limit':169C 'link':3A,33B,106C,138C 'local':75B,157C 'log':65B 'login':151C 'never':43B 'open':135C 'openid':2A,22B,29B,50B,71B,82C,92C,108C,117C,150C 'posit':91C 'provid':51B,118C 'requir':165C 'secur':87C 'self':25B 'self-host':24B 'set':88C 'sign':12A,40B,100C,131C,144C 'signed-in':11A,39B,99C,130C 'skip':73B 'start':44B,104C 'state':170C 'take':8A 'time':168C 'time-limit':167C 'totp':76B,158C 'unsolicit':111C 'user':42B,102C,175C 'valu':171C 'victim':58B,69B,133C,148C 'webauthn':78B,160C 'without':95C","nicknames":[],"mitigations":[],"who_affected":"Instances that allow OpenID 2.0 sign-in or linking of OpenID identities to local accounts are exposed, since the flaw sits in the security settings callback. Instances that do not use OpenID can skip it. Whether the default configuration enables OpenID is unknown in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T19:16:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104627","severity":null,"published_at":"2026-10-18T19:16:32+00:00","modified_at":"2026-10-19T21:17:03+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}