CVE-2026-104627

The Gitea OpenID association callback in the security settings is vulnerable to account hijacking because it accepts positive OpenID 2.0 assertions without verifying that the signed-in user initiated the linking process. Due to the nature of unsolicited assertions, an attacker controlling an Open...