CVE-2026-73535: gitea Missing Critical Step in Authentication

Vulnerability summary

CVE-2026-73535 is a high (CVSS 8.8) Missing Critical Step in Authentication vulnerability in gitea. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.8% of scored vulnerabilities.

Timeline

1. 14-10-2026
   PublishedVulnerability first disclosed.
2. 18-10-2026
   Last modifiedVulnerability information updated.

Description

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.

• CWE-304Missing Critical Step in AuthenticationThe product implements an authentication technique, but it skips a step that weakens the technique.
• CWE-696Incorrect Behavior OrderThe product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.