---
id: CVE-2026-104627
title: Gitea OpenID account linking without session binding
summary: >-
  The Gitea OpenID association callback in the security settings accepted a
  positive OpenID 2.0 assertion without checking that the signed-in user had
  started the linking. Because OpenID 2.0 allows unsolicited assertions, an
  attacker-contr…
severity: none
cwe:
  - CWE-287
  - CWE-352
vendor: Gitea
product: gitea.dev
affected:
  - gitea.dev <= 28.1.0
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T18:51:06.543Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-104627'
references:
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-mf69-7pqq-86vx'
    label: GitHub Security Advisory GHSA-mf69-7pqq-86vx
  - url: 'https://github.com/go-gitea/gitea/pull/39642'
    label: 'Fix: go-gitea/gitea pull request #39642'
  - url: 'https://github.com/go-gitea/gitea/pull/39744'
    label: 'Fix backport to release/v28: go-gitea/gitea pull request #39744'
  - url: 'https://blog.gitea.com/release-of-28.2.0/'
    label: Gitea 28.2.0 release announcement
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v28.2.0'
    label: go-gitea/gitea v28.2.0 release
tags:
  - cve.org
ingestedAt: '2026-10-18T19:51:12.339Z'
---

## Overview

The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.

## Affected

- `gitea.dev <= 28.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.