CVE-2026-25946 - Vulnerability Details - OpenCVE

When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can expose internal service behavior and enable interaction with resources that are not directly reachable by the attacker.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Gitea	Gitea

No data.

No data.

References

Link	Providers
https://github.com/go-gitea/gitea/pull/36729
https://github.com/go-gitea/gitea/security/advisories/GHSA-9574-292w-9wmw

History

Sat, 17 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Gitea Gitea gitea
Vendors & Products		Gitea Gitea gitea

Wed, 14 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 14 Oct 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can expose internal service behavior and enable interaction with resources that are not directly reachable by the attacker.
Title		Gitea OpenID discovery server-side request forgery
Weaknesses		CWE-918
References		https://github.com/go-gitea/gitea/pull/36729 https://github.com/go-gitea/gitea/security/advisories/GHSA-9574-292w-9wmw

MITRE

Status: PUBLISHED

Assigner: Gitea

Published: 2026-10-14T14:28:15.535Z

Updated: 2026-10-14T15:51:01.633Z

Reserved: 2026-02-22T15:13:33.639Z

Link: CVE-2026-25946

Vulnrichment

Updated: 2026-10-14T15:50:53.475Z

NVD

Status : Deferred

Published: 2026-10-14T15:17:19.393

Modified: 2026-10-14T16:17:45.377

Link: CVE-2026-25946

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25946", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-02-22T15:13:33.639Z", "datePublished": "2026-10-14T14:28:15.535Z", "dateUpdated": "2026-10-14T15:51:01.633Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-10-14T14:28:15.535Z"}, "title": "Gitea OpenID discovery server-side request forgery", "descriptions": [{"lang": "en", "value": "When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can expose internal service behavior and enable interaction with resources that are not directly reachable by the attacker."}], "affected": [{"vendor": "Gitea", "product": "Gitea", "packageName": "code.gitea.io/gitea", "defaultStatus": "unaffected", "versions": [{"version": "1.25.4", "status": "affected"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-9574-292w-9wmw", "name": "GitHub Security Advisory GHSA-9574-292w-9wmw", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/36729", "name": "Fix: go-gitea/gitea pull request #36729", "tags": ["patch"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "credits": [{"lang": "en", "value": "https://github.com/DhiyaneshGeek", "type": "reporter"}, {"lang": "en", "value": "https://github.com/neo-ai-engineer", "type": "reporter"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-14T15:50:37.206123Z", "id": "CVE-2026-25946", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T15:51:01.633Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-25946", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-14T15:50:37.206123Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T15:50:53.475Z"}}], "cna": {"title": "Gitea OpenID discovery server-side request forgery", "credits": [{"lang": "en", "type": "reporter", "value": "https://github.com/DhiyaneshGeek"}, {"lang": "en", "type": "reporter", "value": "https://github.com/neo-ai-engineer"}], "affected": [{"vendor": "Gitea", "product": "Gitea", "versions": [{"status": "affected", "version": "1.25.4"}], "packageName": "code.gitea.io/gitea", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-9574-292w-9wmw", "name": "GitHub Security Advisory GHSA-9574-292w-9wmw", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/36729", "name": "Fix: go-gitea/gitea pull request #36729", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can expose internal service behavior and enable interaction with resources that are not directly reachable by the attacker."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-10-14T14:28:15.535Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25946", "state": "PUBLISHED", "dateUpdated": "2026-10-14T15:51:01.633Z", "dateReserved": "2026-02-22T15:13:33.639Z", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "datePublished": "2026-10-14T14:28:15.535Z", "assignerShortName": "Gitea"}, "dataVersion": "5.2"}