Vulnerability · Published Oct 14, 2026 · Assigned by Gitea
CVE-2026-78231Gitea blind SSRF through OpenID assertion verification
Medium 5.3
In plain English
A medium-severity server-side request forgery in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Official description
When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services reachable from the Gitea server. The response is not returned to the attacker, so the issue is blind SSRF; its impact depends on the services and network addresses the server can reach.
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory GHSA-8vmh-w35x-73qr vendor-advisory