{"id":"CVE-2026-104627","aliases":["EUVD-2026-103982","GHSA-mf69-7pqq-86vx"],"status":"published","title":"Gitea OpenID account linking without session binding","description":"The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00119,"percentile":0.01775,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287","CWE-352"],"published":"2026-10-18T18:51:06Z","modified":"2026-10-28T02:30:28Z","products":[{"vendor":"gitea","product":"gitea"}],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-mf69-7pqq-86vx","tags":["vendor-advisory","advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/39642","tags":["patch","fix"]},{"url":"https://github.com/go-gitea/gitea/pull/39744","tags":["patch","fix"]},{"url":"https://blog.gitea.com/release-of-28.2.0/","tags":["release-notes","advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.2.0","tags":["release-notes","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104627.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104627","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-104627","title":"Gitea OpenID account linking without session binding","description":"The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.","status":"published","published":"2026-10-18T18:51:06.543Z","modified":"2026-10-19T20:20:15.46Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-287","CWE-352"],"updated_at":"2026-11-02T14:20:09.448255Z"}],"euvd":[{"id":"EUVD-2026-103982","description":"The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.","status":"published","published":"2026-10-18T18:51:06Z","modified":"2026-10-19T20:20:15Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:46.475674Z"}],"nvd":[{"id":"CVE-2026-104627","description":"The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.","status":"published","published":"2026-10-18T19:16:32.463Z","modified":"2026-10-19T21:17:03.083Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-287","CWE-352"],"updated_at":"2026-11-02T14:13:00.483792Z"}],"osv":[{"id":"CVE-2026-104627","title":"Gitea OpenID account linking without session binding","description":"The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.","status":"published","published":"2026-10-18T18:51:06.543Z","modified":"2026-10-28T02:30:28.269773082Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287","CWE-352"],"updated_at":"2026-11-02T15:44:54.236592Z"}]}}