CVE-2026-73278: Gitea WebAuthn bypass during OAuth and OIDC sign-in
Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.
Affected Software
Event History
Frequently Asked Questions
Which accounts are exposed to this bypass?
The reported scenario affects accounts whose only configured second factor is WebAuthn. Accounts with TOTP configured are outside the reported WebAuthn-only scenario.
What must an attacker be able to do to exploit it?
The attacker must be able to authenticate through an affected OAuth2 or OpenID Connect external identity flow for the target account. They can then obtain a full session without completing the account's WebAuthn challenge.
Can the impact persist after the initial unauthorized session?
Yes. One affected sign-in path can persist an external identity link, which can extend access beyond the initial session.