CVE-2026-78231: Gitea blind SSRF through OpenID assertion verification
When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services reachable from the Gitea server. The response is not returned to the attacker, so the issue is blind SSRF; its impact depends on the services and network addresses the server can reach.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments with OpenID sign-in enabled are exposed. The reachable targets and resulting impact depend on the internal services and network addresses accessible from the Gitea server.
Does an attacker need an account to exploit this?
No. The assertion parameters are processed without authentication, so an unauthenticated attacker can supply the OpenID provider endpoint used during verification.
What can an attacker observe from the vulnerable request?
The attacker can cause Gitea to send an HTTP POST request to a caller-supplied endpoint and control much of its form body. The response is not returned to the attacker, making this a blind SSRF issue.