Server-Side Request Forgery in Forgejo Affects Multiple Versions
CVE-2026-119545

6.9MEDIUM

Key Information:

Vendor

Forgejo

Status
Forgejo
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119545?

The server-side request forgery vulnerability in Forgejo allows unauthenticated attackers to send arbitrary OpenID identifier URLs, leading to unauthorized requests made by the server. By exploiting this flaw, attackers can POST specially crafted identifiers to the /user/login/openid endpoint, which subsequently triggers blind discovery GET requests. This can enable port scanning and probing of loopback, cloud metadata, and internal addresses, posing a serious threat to the security of affected installations.

Affected Version(s)

forgejo 0 <= 15.0.11

forgejo 16.0.0 <= 16.0.7

forgejo 17.0.0 <= 17.0.1

References

https://codeberg.org/forgejo/forgejo/src/tag/v17.0.1/modu...
technical-description
https://abraxaslabs.tech/research/forgejo-openid-discover...
third-party-advisory
https://github.com/go-gitea/gitea/security/advisories/GHS...
relatedvendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
.