Patch Forecast
Amber warning
Patch this week.

CVE-2026-73278

Gitea: authentication bypass

Risk score
72/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.5%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affec…
Affected
Gitea
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: GiteaTHE FLAWSTHE FIXCVE-2026-73278Authentication bypassCVSS 9.8 · EPSS 0%CVE-2026-94205Incorrect authorisationCVSS 9.8 · EPSS 0%CVE-2026-60004Gitea Code InjectionVulnerabilityexploitedCVE-2026-96404Authentication bypassCVSS 8.1 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedGiteaAMBER · PATCH THIS WEEKGiteaGitea Actions decided whether afork pull request run neededapproval based on the user whotriggered the event rather thanthe pull request author. Forpull_request activity triggeredby a maintainer during ordinary…Where it standsExploited in the wildOn CISA's exploited list since 25 AugUS federal deadline 28 AugHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.25 Aug · CISAAdded to the Known Exploited Vulnerabilities list28 Aug · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessAuthentication bypass (CWE-287)236 other warnings in 30 days →Same productEarlier Gitea warnings25 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Gitea: Amber, patch this week. Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pull_request activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow def…

The flaws

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Gitea

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 25 Aug
  • US federal deadline 28 Aug

How it unfolded

  1. 25 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 28 Aug, Deadline (official): US federal agencies must have patched

Connects to

Why it is Amber

  • CVSS 9.8 critical
  • Remotely exploitable without logging in

References

Original description

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.

Last activity 6 Oct 2026. Patch Forecast updates every hour.