Summary
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Gitea ausnutzen, um Informationen offenzulegen.
Product
Gitea ist ein quelloffener Github-Klon.
Vulnerabilities 1
-
Medium 5.3
Gitea blind SSRF through OpenID assertion verification
When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing i…
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-101110
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-8vmh-w35x-73qr vom 2026-09-23
https://github.com/go-gitea/gitea/security/advisories/GHSA-8vmh-w35x-73qr