When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services reachable from the Gitea server. The response is not returned to the attacker, so the issue is blind SSRF; its impact depends on the services and network addresses the server can reach.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Gitea |
|
No data.
No data.
References
History
Sun, 18 Oct 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Sun, 18 Oct 2026 05:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Gitea
Gitea gitea |
|
| Vendors & Products |
Gitea
Gitea gitea |
Wed, 14 Oct 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services reachable from the Gitea server. The response is not returned to the attacker, so the issue is blind SSRF; its impact depends on the services and network addresses the server can reach. | |
| Title | Gitea blind SSRF through OpenID assertion verification | |
| Weaknesses | CWE-918 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: Gitea
Published: 2026-10-14T14:38:10.532Z
Updated: 2026-10-18T13:43:09.650Z
Reserved: 2026-08-24T20:45:09.301Z
Link: CVE-2026-78231
Vulnrichment
Updated: 2026-10-18T13:43:04.231Z
NVD
Status : Deferred
Published: 2026-10-14T15:17:25.533
Modified: 2026-10-18T14:16:56.357
Link: CVE-2026-78231
Redhat
No data.