CVE-2026-73535 Gitea CVE debrief

Who should care

Defenders responsible for Gitea instances, particularly those with OpenID sign-in enabled, should assess exposure and apply mitigations to prevent unauthorized access. IT teams managing user authentication and access controls should verify the use of second factors and restrict access as needed.

Why it matters

CVE-2026-73535 allows an attacker to bypass second-factor authentication in Gitea through OpenID identity linking. Defenders should verify exposure, assess second factor use, and apply patches or mitigating controls to prevent unauthorized access.

• An attacker can sign in without the victim's password or second factor after linking an attacker-controlled identifier.
• A password change does not remove the link, allowing persistent access for the attacker.
• Defenders must verify exposure of Gitea instances to OpenID sign-in and assess the use of second factors.
• Remediation priority is high for Gitea instances with OpenID sign-in enabled.

Technical summary

The vulnerability exists in Gitea's OpenID connect handler, which incorrectly accepts a user's password without verifying enrolled TOTP or WebAuthn before completing sign-in and linking an OpenID identifier. This allows an attacker who knows the victim's password to obtain a session and link an attacker-controlled identifier. The issue impacts Gitea instances with OpenID sign-in enabled, allowing an attacker to sign in without the victim's password or second factor after linking an attacker-controlled identifier. A password change does not remove the link, allowing persistent access for the attacker. Defenders should prioritize verifying exposure of Gitea instances to OpenID sign-in, assessing the use of second

Defensive priority

Defenders should prioritize verifying exposure of Gitea instances to OpenID sign-in, assessing the use of second factors, and applying patches or mitigating controls to prevent unauthorized access.

Recommended defensive actions

• Verify Gitea instances are not exposed to OpenID sign-in or restrict access to trusted sources
• Assess and enforce the use of second factors for all users
• Apply patches or updates to Gitea instances as available
• Monitor for suspicious sign-in activity or linked identifiers
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Gitea's security advisory and release notes offer additional context on the issue and mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.