CVE-2026-73278

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The OAuth2 and OpenID Connect sign-in paths fail to require a WebAuthn challenge when WebAuthn is the only configured second factor for an account. This allows an attacker who can authenticate via these external identity flows to obtain a full session, bypassing the passkey verification typically required during password login. Additionally, one of the affected paths allows the persistence of an external identity link, which can extend the compromise beyond the initial session. Accounts using TOTP (Time-based One-Time Password) are not affected by this specific scenario.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.