CVE-2026-73535: Gitea second-factor bypass through OpenID identity linking
Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Gitea instances with OpenID sign-in enabled are exposed. Accounts that have enrolled TOTP or WebAuthn are still affected because the OpenID identity-linking flow does not require those second factors.
What does an attacker need to exploit it?
The attacker needs to know the victim's password and use the OpenID sign-in flow. They can then create a session and link an attacker-controlled OpenID identifier to the victim's account.
Why does changing the affected user's password not fully remediate the compromise?
A password change does not remove the attacker-controlled linked OpenID identifier. The attacker can continue signing in through that identifier without the victim's password or second factor.