Bug 2563992 (CVE-2026-119545) - CVE-2026-119545 forgejo: Forgejo: Server-Side Request Forgery via OpenID discovery
Summary: CVE-2026-119545 forgejo: Forgejo: Server-Side Request Forgery via OpenID disc...
Keywords:
Status: NEW
Alias: CVE-2026-119545
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2565509 2565510 2565511 2565512
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-30 13:17 UTC by OSIDB Bzimport
Modified: 2026-11-03 02:30 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-30 13:17:41 UTC 
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers can POST crafted identifiers to /user/login/openid to trigger blind discovery GET requests to loopback, cloud metadata, and internal addresses for port scanning and probing.
Note You need to log in before you can comment on or make changes to this bug.