Vulnerability · Published Oct 14, 2026 · Assigned by Gitea

CVE-2026-25946Gitea OpenID discovery server-side request forgery

Medium 5.3

In plain English

A medium-severity server-side request forgery in Gitea from Gitea. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 64.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can expose internal service behavior and enable interaction with resources that are not directly reachable by the attacker.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	1.25.4

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory GHSA-9574-292w-9wmw vendor-advisory
Fix: go-gitea/gitea pull request #36729 patch