Gitea’s OAuth2 avatar synchronization processes the picture claim supplied by an OpenID Connect provider without validating the URL. This flaw allows an attacker to supply a crafted claim that points to an arbitrary HTTP endpoint, forcing the Gitea server to perform a blind outbound request. The operation does not return the response contents, but the side‑effect of making the request can be abused to exfiltrate data or to reach internal resources, effectively creating a blind Server Side Request Forgery.

The issue affects the Gitea Open Source Git Server provided by Gitea. No specific affected version is listed in the record, but the advisory and release notes point to the 1.27.0 release as the first version that includes a patch. Systems running older releases that have not applied the update are potentially vulnerable.

The vulnerability has a CVSS score of 3.1, indicating low severity, and an EPSS score of < 1%, indicating a very low exploitation probability. KEV listing is absent. As a blind Server Side Request Forgery, the potential impact remains high: an attacker with a forged OIDC token can force Gitea to reach arbitrary hosts, enabling information disclosure or internal network scoping. The likely attack vector is through a malicious or compromised OIDC provider that issues an attacker‑controlled picture claim, or an attacker who can influence the OIDC authentication flow on the server side.