CVE-2026-73278
criticalpriority · track · 0EPSS 0.005 · 40 %ileDEUSEPSS · scored 2026-10-26
Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-2863Gitea: Mehrere SchwachstellenDeutsch2026-08-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Berechtigungen zu erweitern, Benutzerkonten zu übernehmen, vertrauliche Informationen offenzulegen oder beliebigen Code als Gitea-Dienstbenutzer auszuführen.
- BIT-gitea-2026-73278Gitea WebAuthn bypass during OAuth and OIDC sign-in2026-10-14vendor · osvUS
Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.
also known as (1)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5) nvd
External citations — patches, advisories, analysis.
- https://blog.gitea.com/release-of-1.27.2/Release Notes
- https://github.com/go-gitea/gitea/pull/38805Patch
- https://github.com/go-gitea/gitea/pull/38810Patch
- https://github.com/go-gitea/gitea/releases/tag/v1.27.2Release Notes
- https://github.com/go-gitea/gitea/security/advisories/GHSA-92j2-6qcg-c28cVendor Advisory
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan