---
id: "CVE-2026-119545"
kind: "vulnerability"
aliases: ["CVE-2026-119545"]
title: "Forgejo: OpenID login lets anyone make the server probe internal addresses"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["forgejo", "openid", "runtime", "self-hosted"]
not_affected_if: ["openid-login-disabled", "version-outside-ranges"]
published_at: "2026-10-30T12:16:40+00:00"
first_seen_at: "2026-10-30T12:30:25+00:00"
updated_at: "2026-10-30T12:32:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119545", "first_seen_at": "2026-10-30T12:30:25+00:00"}]
---

# Forgejo: OpenID login lets anyone make the server probe internal addresses

Forgejo's OpenID login accepts arbitrary identifier URLs and fetches them from the server, so an unauthenticated attacker can make it send requests to loopback, cloud metadata and internal hosts. The attacker gets blind probing and port scanning of the internal network, which can reveal internal services and metadata-reachable secrets.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Forgejo version with `forgejo --version` or the admin dashboard, and compare it to the affected ranges.
- Check whether OpenID sign-in is enabled in the Forgejo admin settings or app.ini.

## Timeline

- 2026-10-30T12:30:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119545

## From the sources

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers can POST crafted identifiers to /user/login/openid to trigger blind discovery GET requests to loopback, cloud metadata, and internal addresses for port scanning and probing.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_