Gitea’s OpenID association callback accepted a positive OpenID 2.0 assertion without verifying that the request was initiated by an authenticated, intent‑to‑link session. This authentication failure (CWE‑287) allowed an attacker controlling an OpenID provider to link their own identity to a victim’s Gitea account. Once linked, the attacker can authenticate as the victim through OpenID, bypassing local two‑factor (TOTP) or WebAuthn checks and gaining full account control.

All Gitea installations that use OpenID authentication and are running a version older than 28.2.0 are affected. The 28.2.0 release contains a fix that requires a time‑limited state value bound to the user in the callback.

The CVSS score of 5.4 and an EPSS score of < 1% indicate a moderate risk, and the vulnerability is not listed in CISA KEV. Attackers must control an OpenID provider and persuade a victim to click a crafted link. Based on the description, the attack vector is inferred to be a phishing or social engineering scenario that relies on the victim’s voluntary interaction. If exploited, the attacker would obtain complete access to the victim’s account and could carry out any actions authorized to that user. Consequently, the risk remains high for deployments that enable OpenID authentication and have not yet applied the patch.