CVE-2026-73278 Gitea CVE debrief

Who should care

Defenders responsible for Gitea instances using WebAuthn as the only second factor for authentication should assess exposure and prioritize remediation. This involves reviewing and updating affected versions to 1.27.2 or later, ensuring proper WebAuthn configuration, and monitoring for suspicious authentication activity. Operators of Gitea platforms, vulnerability management teams, and security teams should also be aware of the potential risks and take必要的

Why it matters

Defenders should prioritize verifying and remediating Gitea instances using WebAuthn as the only second factor for authentication due to potential unauthorized access and persistence of external identity links.

• Potential unauthorized access to Gitea instances without passkey verification
• Possible persistence of external identity links extending compromise beyond initial sessions

Technical summary

The vulnerability allows a party able to authenticate through the affected external identity flow to obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session. This issue affects Gitea instances using WebAuthn as the only second factor for authentication, particularly those with OAuth2 and OpenID Connect sign-in paths. Defenders should focus on verifying and remediating these instances to prevent potential unauthorized access and persistence of external identity links.

Defensive priority

Defenders should prioritize verifying and remediating Gitea instances using WebAuthn as the only second factor for authentication. This involves reviewing and updating affected versions to 1.27.2 or later, ensuring proper WebAuthn configuration, and monitoring for suspicious authentication activity.

Recommended defensive actions

• Verify Gitea instances using WebAuthn as the only second factor for authentication
• Update affected Gitea versions to 1.27.2 or later
• Ensure proper WebAuthn configuration
• Monitor for suspicious authentication activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the WebAuthn bypass vulnerability in Gitea's OAuth2 and OpenID Connect sign-in paths. The vendor has released a patched version (1.27.2) and provided advisories and pull requests for mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.