{"id":"CVE-2026-73278","published":"2026-10-06T20:17:29Z","modified":"2026-10-13T16:53:31Z","title":"Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's…","vendor":"Gitea","product":"Gitea","tier":"core","eol":null,"description":{"text":"Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.","provenance":"source","from":"NVD"},"summary":{"text":"Gitea's OAuth2 and OpenID Connect sign-in paths fail to enforce a WebAuthn challenge for accounts whose only configured second factor is WebAuthn, so the passkey check applied during password login is skipped. An attacker able to authenticate through the affected external identity flow can obtain a full session without passkey verification, and one affected path can also persist an external identity link that extends the compromise beyond that session; accounts with TOTP configured are not part of this scenario.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:18:45Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00466,"percentile":0.40334,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 15, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6acf98726e4260f2f2ba3d49","created":"2026-10-14"},{"name":"Known_Cve | Oct 14, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ace466c18a71dd7afa3f788","created":"2026-10-13"},{"name":"Known_Cve | Oct 13, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6accf723f346ce4b8a50d55a","created":"2026-10-12"},{"name":"Known_Cve | Oct 12, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6acba8a68a86c4d9508005a7","created":"2026-10-11"},{"name":"Known_Cve | Oct 11, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6aca554665c47eb24716f8f2","created":"2026-10-10"},{"name":"Known_Cve | Oct 10, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac90361476f45b4b982597d","created":"2026-10-09"},{"name":"Known_Cve | Oct 9, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac7b1a3f215e7af4290dc2e","created":"2026-10-08"},{"name":"Known_Cve | Oct 8, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac65e5b607642608f852c9a","created":"2026-10-07"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.2/","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/38805","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/38810","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-92j2-6qcg-c28c","tags":["Vendor Advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-93940","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93940","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-06","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73278","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":17.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":8.07,"detail":"percentile 0.4033"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}