CVE-2026-78231

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description When OpenID sign-in is enabled, the software processes unauthenticated assertion parameters and sends an HTTP POST request to a caller-supplied OpenID provider endpoint during verification. This allows an attacker to control the destination and a significant portion of the form body, enabling interaction with internal HTTP services reachable from the server. This is a blind Server-Side Request Forgery (SSRF), a condition where the server is coerced into making requests to an unintended location without returning the response to the attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.