CVE-2026-104627: Gitea OpenID Authentication Bypass Vulnerability

CVE-2026-104627 Overview

CVE-2026-104627 is an authentication flaw in Gitea's OpenID association callback within the security settings. The callback accepted a positive OpenID 2.0 assertion without verifying that the signed-in user had initiated the linking flow. Because OpenID 2.0 permits unsolicited assertions, an attacker-controlled OpenID provider can bind the attacker's identity to a victim's account when the victim opens a crafted link. The attacker can then authenticate as the victim through OpenID login, which bypasses local TOTP and WebAuthn checks. The weakness is categorized under [CWE-287: Improper Authentication].

Critical Impact
An attacker who tricks an authenticated Gitea user into visiting a crafted URL can link an attacker-controlled OpenID identity to the victim's account and subsequently log in as the victim, bypassing multi-factor authentication.

Affected Products

Gitea self-hosted Git service
Gitea versions prior to 28.2.0
Deployments with OpenID 2.0 authentication enabled

Discovery Timeline

2026-10-18 - CVE-2026-104627 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-104627

Vulnerability Analysis

The vulnerability resides in Gitea's OpenID association callback handler used from the user security settings page. When the callback received a signed, positive OpenID 2.0 assertion, it associated the asserted OpenID identifier with the currently signed-in session without verifying that the user had actually begun a linking request. The handler trusted assertion validity alone as proof of user intent.

OpenID 2.0 explicitly allows unsolicited positive assertions, meaning a provider can send a valid assertion that the relying party never requested. In Gitea, this made the callback a one-click identity-binding endpoint. Once the attacker's OpenID is attached, the attacker can authenticate via the OpenID login path, which does not enforce the account's local second factor such as Time-based One-Time Password (TOTP) or WebAuthn.

Root Cause

The callback lacked a Cross-Site Request Forgery (CSRF) style binding between the login session and the pending association request. There was no server-stored, time-limited state value tied to the user that the callback could validate before accepting the assertion.

Attack Vector

The attack requires user interaction. An attacker operates or controls an OpenID provider and prepares an unsolicited assertion for their chosen identifier. The attacker then sends a crafted link to a signed-in Gitea user. When the victim opens it, the browser reaches the association callback carrying the assertion. Gitea binds the attacker's OpenID to the victim's account. The attacker subsequently signs in via OpenID and inherits the victim's privileges without triggering TOTP or WebAuthn.

No synthetic exploit code is published here. See the GitHub Security Advisory GHSA-mf69-7pqq-86vx and Gitea Pull Request #39642 for technical specifics.

Detection Methods for CVE-2026-104627

Indicators of Compromise

New entries in the external_login_user table (or equivalent OpenID association records) that users do not recognize.
Successful OpenID logins for accounts that previously authenticated only with password plus TOTP or WebAuthn.
Access to the OpenID association callback endpoint without a preceding request to the association initiation endpoint in the same session.

Detection Strategies

Correlate web access logs for requests to the OpenID association callback that are not preceded by the user visiting the security settings page.
Alert on account logins whose authentication method suddenly switches from local plus multi-factor to OpenID.
Audit Gitea admin panels for OpenID identifiers added to privileged accounts since OpenID 2.0 was enabled.

Monitoring Recommendations

Forward Gitea application logs and reverse-proxy access logs to a centralized logging platform for retention and search.
Enable Gitea audit logging and monitor security-settings events, especially identity linking and unlinking actions.
Track OpenID provider domains observed in callback traffic and alert on providers not on an approved allowlist.

How to Mitigate CVE-2026-104627

Immediate Actions Required

Upgrade Gitea to version 28.2.0 or later, which requires a time-limited state value bound to the user in the OpenID association callback.
Review all existing OpenID associations in user accounts, particularly for administrators and repository owners, and remove any that users cannot attest to initiating.
Force a password reset and session invalidation for accounts suspected of compromise, and require re-enrollment of multi-factor authentication.

Patch Information

The fix is included in Gitea 28.2.0. See the Gitea Version 28.2.0 Release notes, the Gitea Release v28.2.0 tag, and the upstream fixes in Gitea Pull Request #39642 and Gitea Pull Request #39744.

Workarounds

Disable OpenID 2.0 authentication in Gitea configuration until the instance is upgraded.
Restrict access to the Gitea instance to trusted networks or require authenticated reverse-proxy access while the patch is deployed.
Instruct users to avoid opening unsolicited links to the Gitea instance and to review their linked identities after upgrade.

bash

# Disable OpenID sign-in in app.ini until upgrade to 28.2.0 or later
[openid]
ENABLE_OPENID_SIGNIN = false
ENABLE_OPENID_SIGNUP = false