Bug 2552363 (CVE-2026-73535)

Summary: CVE-2026-73535 code.gitea.io/gitea: Gitea: Multi-factor authentication bypass via missing verification in OpenID Connect linking
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: gbenhaim, niyer, twaugh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Gitea. When OpenID Connect sign-in is enabled, the authentication handler verifies a user's password but fails to enforce enrolled second-factor authentication, such as a Time-based One-Time Password (TOTP) or security key. A remote attacker with knowledge of a victim's password can exploit this vulnerability to link an external identity without second-factor verification, resulting in persistent account takeover that survives subsequent password changes.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-14 14:53:21 UTC 
Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.