Gitea’s OAuth2 and OpenID Connect sign‑in paths do not present a WebAuthn challenge when WebAuthn is the only second factor configured for an account. This flaw allows an attacker who can authenticate through the external identity provider to obtain a valid Gitea session without presenting the required passkey. The effect is that the attacker can impersonate the user for the duration of the session and potentially access all data and actions the user can perform.

The vulnerability affects installations of Gitea that use OAuth2 or OIDC as an authentication method and have WebAuthn set as the sole second factor. Versions prior to the release that includes the fix – notably Gitea 1.27.2 and earlier – are impacted. Users with total TOTP as a second factor are not included in the reported scenario.

Because the flaw can be exploited entirely over the external identity flow, the attack vector is remote and requires only ability to authenticate to the configured identity provider. No local privileges are needed. The CVSS score of 9.8 indicates critical severity, while the EPSS score of < 1% suggests a low exploitation probability at present. The vulnerability is not listed in CISA KEV, so no confirmed public exploit exists. Nonetheless, the ability to bypass the WebAuthn second factor removes the intended authentication guard, giving an attacker full session control during the OAuth/OIDC sign‑in. The impact is a complete bypass of the second‑factor authentication step.