{"id":"CVE-2026-119545","kind":"vulnerability","aliases":["CVE-2026-119545"],"related":[],"title":"Forgejo: OpenID login lets anyone make the server probe internal addresses","description":"Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers can POST crafted identifiers to /user/login/openid to trigger blind discovery GET requests to loopback, cloud metadata, and internal addresses for port scanning and probing.","summary":"Forgejo's OpenID login accepts arbitrary identifier URLs and fetches them from the server, so an unauthenticated attacker can make it send requests to loopback, cloud metadata and internal hosts. The attacker gets blind probing and port scanning of the internal network, which can reveal internal services and metadata-reachable secrets.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["forgejo","openid","runtime","self-hosted"],"not_affected_if":["openid-login-disabled","version-outside-ranges"],"how_to_check":"- Check the installed Forgejo version with `forgejo --version` or the admin dashboard, and compare it to the affected ranges.\n- Check whether OpenID sign-in is enabled in the Forgejo admin settings or app.ini.","fix":null,"status":"open","published_at":"2026-10-30T12:16:40+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","triaged_at":"2026-10-30T12:32:28+00:00","updated_at":"2026-10-30T12:32:28+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T12:32:28Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Forgejo release newer than the affected ranges: `15.0.12` or later on the 15 line, `16.0.8` or later on the 16 line, `17.0.2` or later on the 17 line (inferred from the ranges; the sources give no fixed version).\n- unknown","reach":"internet","title":"Forgejo: OpenID login lets anyone make the server probe internal addresses","impact":"medium","summary":"Forgejo's OpenID login accepts arbitrary identifier URLs and fetches them from the server, so an unauthenticated attacker can make it send requests to loopback, cloud metadata and internal hosts. The attacker gets blind probing and port scanning of the internal network, which can reveal internal services and metadata-reachable secrets.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["forgejo","self-hosted","openid"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Server sends requests to internal hosts and cloud metadata, enabling port scanning","analyst_note":"Confirm the fixed versions and whether OpenID login is on by default, using the Forgejo release notes or the advisory linked from NVD.","how_to_check":"- Check the installed Forgejo version with `forgejo --version` or the admin dashboard, and compare it to the affected ranges.\n- Check whether OpenID sign-in is enabled in the Forgejo admin settings or app.ini.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["openid-login-disabled","version-outside-ranges"],"who_is_affected":"Self-hosted Forgejo instances in the affected version ranges that allow OpenID sign-in are exposed, because the login endpoint fetches attacker-supplied URLs without restriction. Instances without OpenID login enabled, or running a version outside these ranges, can skip this. unknown for whether hosted or managed Forgejo deployments are patched.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000779,"input_tokens":4204,"output_tokens":717,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119545':14A,17A '-2026':13A,16A '/user/login/openid':116C '15.0.11':78C '16.0.0':79C '16.0.7':81C '17.0.0':83C '17.0.1':85C 'accept':28B 'address':11A,129C 'allow':95C 'anyon':5A 'arbitrari':29B,106C 'attack':41B,55B,97C,110C 'blind':57B,119C 'cloud':49B,125C 'contain':86C 'craft':113C 'cve':12A,15A 'discoveri':120C 'fetch':33B 'forgejo':1A,18B,24B,76C 'forgeri':92C 'get':56B,121C 'host':23B,53B 'identifi':30B,108C,114C 'intern':10A,52B,64B,69B,128C 'issu':102C 'let':4A 'login':3A,27B 'loopback':48B,124C 'make':6A,43B,99C 'metadata':50B,73B,126C 'metadata-reach':72B 'network':65B 'openid':2A,19B,26B,107C 'port':60B,131C 'post':112C 'probe':9A,58B,134C 'reachabl':74B 'request':46B,91C,103C,122C 'reveal':68B 'runtim':20B 'scan':61B,132C 'secret':75B 'self':22B 'self-host':21B 'send':45B 'server':8A,37B,89C,101C 'server-sid':88C 'servic':70B 'side':90C 'submit':105C 'trigger':118C 'unauthent':40B,96C 'url':31B,109C 'vulner':93C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Forgejo instances in the affected version ranges that allow OpenID sign-in are exposed, because the login endpoint fetches attacker-supplied URLs without restriction. Instances without OpenID login enabled, or running a version outside these ranges, can skip this. unknown for whether hosted or managed Forgejo deployments are patched.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119545","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119545","severity":null,"published_at":"2026-10-30T12:16:40+00:00","modified_at":"2026-10-30T12:16:40+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","fetched_at":"2026-10-30T12:30:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}