CVE-2026-25946

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description When OpenID sign-in is enabled, the software accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. This allows an unauthenticated remote attacker to force the server to contact loopback or private-network HTTP services, potentially exposing internal service behavior and enabling interaction with resources not directly reachable by the attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.