Gitea: Second-factor bypass through OpenID identity linking
Summary
Gitea's OpenID Connect handler accepts a user's password without enforcing TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. An attacker who knows the victim's password can obtain a session, link an attacker-controlled OpenID identifier and later sign in through it without the password or second factor. The link survives a password change. The issue only applies when OpenID sign-in is enabled.
Affected
- Gitea 0 to 1.27.1 (per the CVE record and third-party trackers; the vendor release notes do not state the range)
- Gitea Cloud and Gitea Enterprise: affected before the fix in v1.27.3 (Gitea Cloud) and 27.3.0 (Gitea Enterprise)
Fixed in
- Gitea 1.27.2 (PRs #38805 and #38810)
- Gitea Cloud v1.27.3
- Gitea Enterprise 27.3.0
- Self-built or distribution packages: Unknown beyond 1.27.2.
Workaround
- Unknown. The vendor recommends upgrading.
- If an upgrade is not possible immediately, disabling OpenID sign-in removes the affected code path (own inference, not from a vendor source).
Exploitation
- No evidence of exploitation in the wild for CVE-2026-73535 found in the sources reviewed.
- No public proof of concept found; this does not prove none exists.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Upgrade to Gitea 1.27.2 or later (or the vendor-specific fixed release).
- Check whether OpenID sign-in is enabled; if it is not, the risk is reduced.
- Review the linked OpenID identities of all accounts and remove unknown entries, since a password change does not remove them.
- Check whether the instance was internet-facing before patching and review logins for unusual activity.
- Review older instances for CVE-2026-60004 (remote code execution via Git hooks, fixed in 1.27.1), which is known to be exploited.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Gitea 1.27.2 is released blog.gitea.com
- GHSA-8xjr-x7rg-hp5h security advisory github.com
- Gitea v1.27.2 release github.com
- Pull request #38805 github.com
- Pull request #38810 github.com
- OSV record CVE-2026-73535 osv.dev
- Gitea Cloud release 1.27.3 about.gitea.com
- Gitea Enterprise release 27.3.0 about.gitea.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:51.
Original description (NVD)
Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.