CVE-2026-120263

The Gitea platform is vulnerable to an account takeover via the OAuth2 account auto-linking feature. When [oauth2_client].ACCOUNT_LINKING is set to auto and registration is enabled, the link-account sign-up form incorrectly identifies accounts using the username or email submitted in the form rat...