CVE-2026-23603

CVE-2026-23603 describes a blind SSRF in Gitea’s OAuth2 avatar synchronization when UPDATE_AVATAR is enabled. The vulnerability arises from using the user-provided OAuth/OIDC avatar URL (often the picture claim) and performing an unrestricted HTTP GET with Go’s default client, without host/IP res...