Gitea’s OpenID sign‑in flow improperly processes unauthenticated assertion parameters and, during verification, sends an HTTP POST to a caller‑supplied OpenID provider endpoint. An attacker can dictate the destination URL and much of the form body, enabling the server to initiate internal HTTP requests. Because the response is not returned to the attacker, the flaw is a blind SSRF. The impact is limited to the internal services that the Gitea instance can reach, but it can allow sensitive data exposure, lateral movement, or privilege escalation within the local network.

Any Gitea installation that has OpenID sign‑in enabled is potentially affected. Specific version information is not listed, so all current releases should be inspected for the fix referenced in the advisory.

The CVSS score of 5.3 indicates a medium severity for this blind SSRF flaw. The EPSS score of < 1% reflects a very low probability of exploitation, yet the lack of authentication requirements and ability to target any internal resource can still pose a significant risk. The vulnerability is not listed in the CISA KEV catalog, but it remains exploitable by any actor with network access to the Gitea server. An attacker can choose any reachable internal address for the POST request, making the risk dependent on the internal topology. The likely attack vector is a remote attacker who can supply a forged OpenID assertion during the sign‑in process.