CVE-2026-73535 Details
Description
Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.
A vulnerability in Gitea's OpenID Connect authentication process allows an attacker to bypass two-factor authentication (2FA) requirements, specifically TOTP and WebAuthn, before linking an OpenID identifier to a victim's account. This issue is present in Gitea versions through 1.27.1. When OpenID sign-in is enabled, an attacker who knows the victim's password can gain full access to the victim's account by exploiting this flaw. The attacker's OpenID identifier remains linked to the account even after a password change, allowing continued access without the password or 2FA.
Users can upgrade to Gitea version 1.27.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-1.27.2/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/38805 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/38810 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.2 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-8xjr-x7rg-hp5h | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-304 | Missing Critical Step in Authentication | Gitea Limited |
| CWE-696 | Incorrect Behavior Order | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 1.27.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | Gitea Limited |