A blind Server-Side Request Forgery (SSRF) exists when the `[oauth2 client] UPDATE AVATAR = true` setting is enabled. The issue occurs because the server fetches the avatar URL provided by an OAuth2/OIDC provider—typically the `picture` claim—using the default Go HTTP client without applying outbound host or IP restrictions. A low-privileged user who can influence their own `picture` claim can force the Gitea server to make arbitrary outbound HTTP GET requests to loopback addresses, RFC 1918 private network addresses, and IPv4 link-local addresses such as `169.254.169.254`.
Technical details include:
- **Vulnerable Function**: `oauth2UpdateAvatarIfNeed()` in `routers/web/auth/oauth.go` and `oauth2SignInSync()` in `routers/web/auth/oauth signin sync.go`.
- **Vulnerable Variable**: `gothUser.AvatarURL`.
While the issue is primarily blind because non-image responses are rejected, the impact increases if the server can reach cloud metadata services or internal services that return valid image data, which could then be stored as the user's avatar.