CVE-2026-25946: Gitea OpenID discovery server-side request forgery
When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can expose internal service behavior and enable interaction with resources that are not directly reachable by the attacker.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it if OpenID sign-in is enabled and can submit an OpenID URL to the Gitea instance.
What systems are at risk from the server-side request?
The attacker can cause Gitea to make HTTP requests to loopback or private-network services that are not directly reachable from the attacker. This may expose internal service behavior or permit interaction with those resources.
Is a default Gitea deployment affected?
The issue requires OpenID sign-in to be enabled. The provided information does not establish whether OpenID sign-in is enabled by default.
What can be done if patching is not immediately possible?
Disable OpenID sign-in to prevent user-supplied OpenID discovery URLs from triggering server-side requests.