Read the docs
TI-2026-68505 Aliases CVE-2026-73278

WebAuthn bypass in Gitea OAuth and OIDC sign-in

Priority MEDIUM 49CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.

Summary

Gitea versions from 1.16.0 through 1.27.1 are affected. Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only second factor, which is an improper authentication flaw (CWE-287). A party able to authenticate through the external identity flow can obtain a full session without the passkey verification that password login enforces. One affected path can also persist an external identity link, extending the compromise beyond the initial session.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00466 40th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GiteaGitea1.16.0 – 1.27.1—No fix listedCNA
  • Gitea VendorGitea Affected 1.16.0 – 1.27.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*1.16.0 to before 1.27.2VulnerableGitea
  • cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:* Versions 1.16.0 to before 1.27.2 Vulnerable ·Gitea

Remediation

The sources list no fixed version for Gitea.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-73278
  2. 2026-10-07 CVSS score added · CISA ADP
  3. 2026-10-07 CISA SSVC decision points changed
  4. 2026-10-07 Priority changed: LOW → MEDIUM

References

Patch 2

Advisory 1

Other 2

  • TI-2026-42785 Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-11072 The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote… CVSS 3.1HIGH 7.2
  • TI-2022-12910 Gitea before 1.16.7 does not escape git fetch remote. CVSS 3.1HIGH 7.5
  • TI-2019-08404 models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror… CVSS 3.1HIGH 8.8
  • TI-2022-00955 Open Redirect on login in go-gitea/gitea CVSS 3.1MEDIUM 6.1
  • TI-2026-68968 Push-to-create bypass of FORCE_PRIVATE policy in Gitea CVSS 3.1MEDIUM 5.4
See all 80 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences