Weakness in Gitea's OpenID Connect Handler Allows Account Linking Without Verification

CVE-2026-73535

What is CVE-2026-73535?

The OpenID connect handler in Gitea is susceptible to a significant vulnerability that allows an attacker to bypass two-factor authentication. When users enable OpenID sign-in, their credentials are inadequately protected, as the handler can erroneously accept a user's password without requiring additional verification through Time-based One-Time Password (TOTP) or WebAuthn. This flaw means that if an attacker obtains a victim's password, they can create a session linked to a controlled identifier. As a result, the attacker can gain access without needing the victim's password or the second factor, leaving the account vulnerable even if the victim changes their password.

References