CVE-2026-119545: Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery

Published Oct 30, 2026

Updated

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers can POST crafted identifiers to /user/login/openid to trigger blind discovery GET requests to loopback, cloud metadata, and internal addresses for port scanning and probing.

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Forgejo versions through 15.0.11, versions 16.0.0 through 16.0.7, and versions 17.0.0 through 17.0.1 are affected. The vulnerable endpoint is /user/login/openid.

Does exploitation require an account or user interaction?

No. An unauthenticated attacker can submit a crafted OpenID identifier URL to the endpoint, and no user interaction is required.

What can an attacker reach through this issue?

The server can be induced to perform blind OpenID discovery GET requests to attacker-selected addresses, including loopback, cloud metadata, and internal network addresses. This can be used for internal probing and port scanning.

CVE-2026-119545: Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require an account or user interaction?

What can an attacker reach through this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require an account or user interaction?

What can an attacker reach through this issue?