CVE-2026-23603

The Gitea software is vulnerable to a Blind Server-Side Request Forgery (SSRF) during the OAuth2 avatar synchronization process. The root cause is an unvalidated OIDC picture claim within the gitea.dev component. This vulnerability allows an attacker to potentially trigger server-side requests to...