CVE-2026-104627

CVE-2026-104627 · Gitea OpenID account linking without session binding

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.

CVSS 5.4 · Средний · EPSS 0,1%

Опубликовано

2026-10-18T18:51:06.543Z

Обновлено

2026-10-19T20:20:15.460Z

Проверьте свой сервер →