P5Verified

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

CVE-2026-23603 affects code.gitea.io/gitea. CVSS base score 3.1 (GitHub Advisory Database). EPSS 0.0029 (percentile 0.19551), scored 2026-10-03. Affected range: < 1.27.0. Fixed version: 1.27.0.

CVE: CVE-2026-23603
Product: code.gitea.io/gitea
CCR priority: 12.5 /100 (P5)
CVSS: 3.1 /10 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N · GitHub Advisory Database
EPSS: 0.0029 · percentile 0.19551 · 2026-10-03
KEV: no

Affected products

code.gitea.io/gitea · < 1.27.0 · Fixed version: 1.27.0

Provenance

GitHub Advisory Database · Source record · observed 2026-10-04 13:35:46.601730+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-23603.html