Missing Critical Step in Authentication in Gitea - CVE-2026-73535
Published: August 15, 2026
Vulnerability details
The vulnerability allows a remote user to bypass second-factor authentication and take over accounts.
The vulnerability exists due to missing critical step in authentication in the POST /user/openid/connect handler when processing OpenID connect sign-in requests. A remote user can submit a known victim password through the OpenID connect flow to bypass second-factor authentication and take over accounts.
OpenID sign-in is enabled by default on instances set up through the installer. On affected accounts, an attacker-controlled OpenID identifier can be linked before sign-in completes, allowing subsequent access without the victim\'s password and surviving password changes until the linked identifier is removed.