Gitea allows a user to supply an arbitrary OpenID URL when OpenID sign‑in is enabled. The server performs discovery requests to that URL without validating the target against internal or private address ranges. An unauthenticated attacker can therefore cause the Gitea server to reach loopback or private‑network HTTP services, revealing internal service responses and enabling interaction with resources that would otherwise be unreachable. This flaw is a classic Server‑Side Request Forgery identified as CWE‑918, allowing attackers to gather internal network information or potentially reach internal services for further exploitation.

The vulnerability affects all Gitea installations that have OpenID sign‑in enabled. No specific version ranges are supplied in the CVE record, so any Gitea deployment running the affected code is potentially vulnerable until a patch is applied.

The CVSS score of 5.3 classifies the flaw as moderate. The EPSS score is 0.00408 (~0.4%). The vulnerability is not currently listed in CISA’s KEV catalog, suggesting limited exploitation at present. Nevertheless, the flaw enables a remote attacker to trigger outbound connections to internal hosts, which could expose sensitive data or provide a foothold for additional attacks. The required conditions are minimal: the target must allow OpenID authentication and the attacker must supply a crafted OpenID URL. The attack rationale is straightforward: submit a malicious URL, cause the server to reach a private resource, and read the response. This potential for internal discovery warrants prompt mitigation.