CVE-2026-73535— Gitea second-factor bypass through OpenID identity linking
Quick assessment
Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Gitea 的 OpenID Connect 处理程序在完成登录并绑定 OpenID 标识符时，未强制执行已注册的 TOTP 或 WebAuthn 验证，仅接受用户的密码。当启用 OpenID 登录功能时，攻击者如果知道受害者的密码，便可获取会话并将攻击者控制的标识符绑定到受害者账户。随后，攻击者可以通过该绑定标识符进行登录，而无需提供受害者的密码或第二因素（2FA），且更改密码也不会解除该绑定关系。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73535
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitea second-factor bypass through OpenID identity linking
Source: CVE Program / CVE List V5
Vulnerability Description
Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
认证中关键步骤缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-73535
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73535
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-73535 (2)
Vendor Pages for CVE-2026-73535 (1)
-
🔗 Release v1.27.2 · go-gitea/gitea · GitHub release-notes
Other References for CVE-2026-73535 (1)
Other References for CVE-2026-73535 (1)
-
https://blog.gitea.com/release-of-1.27.2/ release-notes
Same Patch Batch · Gitea · 2026-10-14 · 36 CVEs total
| CVE-2026-62925 | Gitea Alpine package parsing memory exhaustion | |
| CVE-2026-70407 | Gitea organization listing token scope bypass | |
| CVE-2026-70396 | Gitea organization repository creation token scope bypass | |
| CVE-2026-70406 | Gitea private comparison disclosure with public-only tokens | |
| CVE-2026-70400 | Gitea private migration creation with public-only tokens | |
| CVE-2026-70402 | Gitea local code execution through writable Git hooks | |
| CVE-2026-67577 | Gitea restricted-user activity and heatmap disclosure | |
| CVE-2026-63792 | Gitea private reusable workflow disclosure to fork runs | |
| CVE-2026-63021 | Gitea Swift package manifest memory exhaustion | |
| CVE-2026-59774 | Gitea Org-mode file disclosure and code execution | |
| CVE-2026-68964 | Gitea restricted-user SSH and GPG key metadata disclosure | |
| CVE-2026-68957 | Gitea restricted-user issue search disclosure | |
| CVE-2026-73814 | Gitea repository ownership escalation by administrators | |
| CVE-2026-73800 | Gitea reusable workflow secret exposure in pull_request_target | |
| CVE-2026-73804 | Gitea API token scope escalation through HTTP signatures | |
| CVE-2026-73539 | Gitea external renderer argument injection and code execution | |
| CVE-2026-78231 | Gitea blind SSRF through OpenID assertion verification | |
| CVE-2026-78433 | Gitea private attachment disclosure through repository mismatch | |
| CVE-2026-73130 | Gitea repository initialization resource exhaustion | |
| CVE-2026-73802 | Gitea Runner host isolation bypass through container options |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Gitea
-
CVE-2026-78433
Gitea private attachment disclosure through repository misma -
CVE-2026-78231
Gitea blind SSRF through OpenID assertion verification -
CVE-2026-73814
Gitea repository ownership escalation by administrators -
CVE-2026-73804
Gitea API token scope escalation through HTTP signatures -
CVE-2026-73800
Gitea reusable workflow secret exposure in pull_request_targ
Same vendor: Gitea
-
CVE-2026-78433
Gitea private attachment disclosure through repository misma -
CVE-2026-78231
Gitea blind SSRF through OpenID assertion verification -
CVE-2026-73814
Gitea repository ownership escalation by administrators -
CVE-2026-73804
Gitea API token scope escalation through HTTP signatures -
CVE-2026-73802
Gitea Runner host isolation bypass through container options
Same weakness: CWE-304
-
CVE-2026-89068
MOVEit Transfer Authentication bypass in LDAP sign-on -
CVE-2026-108071
Improper Multi-Factor Authentication Validation Allows Authe -
CVE-2026-93994
Apache MINA SSHD: Repeated-publickey policy bypass on server -
CVE-2026-94052
Apache MINA SSHD: LDAP password authentication ineffective -
CVE-2026-100667
grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authenticat
V. Comments for CVE-2026-73535
No comments yet