EUVD-2026-101110

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services...

CVE-2026-78231: Server-Side Request Forgery (SSRF)

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services...

PT-2026-114290

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description When OpenID sign-in is enabled, the software processes unauthenticated assertion parameters and sends an HTTP POST request to a caller-supplied OpenID provider endpoint during verification. Thi...