CVE-2026-73535
Description
A flaw was found in Gitea. When OpenID Connect sign-in is enabled, the authentication handler verifies a user's password but fails to enforce enrolled second-factor authentication, such as a Time-based One-Time Password (TOTP) or security key. A remote attacker with knowledge of a victim's password can exploit this vulnerability to link an external identity without second-factor verification, resulting in persistent account takeover that survives subsequent password changes.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
