Gitea’s OpenID Connect handler accepts a user’s password without enforcing previously enrolled TOTP or WebAuthn verification, allowing an attacker who knows a victim’s password to link an attacker‑controlled OpenID identifier to the victim’s account. Once linked, the attacker can subsequently authenticate through that identifier without the victim’s password or second factor, and the link persists even after the victim changes their password. This represents a failure to enforce multi‑factor authentication (CWE‑304) and a disabling of a security mechanism during account linking (CWE‑696).

All Gitea instances running a version earlier than 1.27.2 that have the OpenID Connect feature enabled are affected. The fix is included in the 1.27.2 release, so any deployment of Gitea before that version should be considered vulnerable until upgraded. The issue does not depend on a specific client or infrastructure component; it impacts the Gitea application as a whole.

An attacker only requires knowledge of a valid user’s password and a server with OpenID Connect enabled. There are no additional network restrictions or special privileges needed; the exploit can be carried out through the normal authentication endpoint. The EPSS score is listed as < 1%, and the vulnerability is not currently in the CISA KEV catalogue. However, the loss of two‑factor authentication and the persistence of the unauthorized link make the risk high, especially for accounts that continue to use the compromised OpenID identifier after the attacker has an established session.