CVE-2026-104627

The Gitea OpenID association callback in security settings is vulnerable to account linking without session binding. The root cause is that the system accepted positive OpenID 2.0 assertions without verifying that the signed-in user initiated the linking process. An attacker controlling an OpenID...