CVE-2026-104627: Gitea OpenID account linking without session binding
The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited state value bound to the user.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to account takeover?
A signed-in Gitea user can be targeted if they open a crafted link that causes an attacker-controlled OpenID provider to submit an unsolicited positive OpenID 2.0 assertion. The attacker can then use the linked OpenID identity to sign in as that user.
Does local multi-factor authentication prevent the resulting login?
No. The OpenID login path described does not apply local TOTP or WebAuthn checks, so an attacker signing in through the attached OpenID identity can bypass those local checks.
What change prevents this attack?
The callback must require a time-limited state value that is bound to the signed-in user who initiated the OpenID linking flow. This ensures the association callback cannot be accepted unless that user started the linking process.