{"id":"CVE-2026-25946","summary":"Gitea OpenID discovery server-side request forgery","details":"When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can expose internal service behavior and enable interaction with resources that are not directly reachable by the attacker.","aliases":["GHSA-9574-292w-9wmw"],"modified":"2026-10-15T02:47:30.864580717Z","published":"2026-10-14T14:28:15.535Z","database_specific":{"cna_assigner":"Gitea","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25946.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25946.json"},{"type":"FIX","url":"https://github.com/go-gitea/gitea/pull/36729"},{"type":"ADVISORY","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9574-292w-9wmw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25946"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/go-gitea/gitea","events":[{"introduced":"369830bada2fd8826a5135cb2fc66660a9bef708"},{"last_affected":"369830bada2fd8826a5135cb2fc66660a9bef708"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"1.25.4"},{"last_affected":"1.25.4"}]}}],"versions":["1.25.4","v1.25.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25946.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}