CVE-2026-73535: Gitea 0 through 1.27.1

Affected technology

Gitea · 0 through 1.27.1
Gitea

Description’s affected range: before completing sign-in and linking an OpenID identifier

Component: Not specified by the source

What an attacker can do

The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.