Gitea’s OpenID sign‑in flow improperly processes unauthenticated assertion parameters and, during verification, sends an HTTP POST to a caller‑supplied OpenID provider endpoint. An attacker can dictate the destination URL and much of the form body, enabling the server to initiate internal HTTP requests. Because the response is not returned to the attacker, the flaw is a blind SSRF. The impact is limited to the internal services that the Gitea instance can reach, but it can allow sensitive data exposure, lateral movement, or privilege escalation within the local network.

Any Gitea installation that has OpenID sign‑in enabled is potentially affected. Specific version information is not listed, so all current releases should be inspected for the fix referenced in the advisory.

The CVSS score is not disclosed in the available data, but the EPSS score of 0.00168 indicates a very low exploitation probability, although the blind SSRF nature and lack of authentication requirements still make the potential impact high. The vulnerability is not listed in the CISA KEV catalog, but it remains exploitable by any actor with network access to the Gitea server. An attacker can choose any reachable internal address for the POST request, making the risk dependent on the internal topology. The likely attack vector is a remote attacker who can supply a forged OpenID assertion during the sign‑in process.