CVE-2026-73278

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.

• CWE-287

• https://blog.gitea.com/release-of-1.27.2/Release Notes
• https://github.com/go-gitea/gitea/pull/38805Patch
• https://github.com/go-gitea/gitea/pull/38810Patch
• https://github.com/go-gitea/gitea/releases/tag/v1.27.2Release Notes
• https://github.com/go-gitea/gitea/security/advisories/GHSA-92j2-6qcg-c28cVendor Advisory

Published

Oct 6, 2026

Last Modified

Oct 13, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73268A flaw was found in the cluster-curator-controller component…9.9
• CVE-2026-73269A flaw was found in the cluster-curator-controller component…9.9
• CVE-2026-7327An improper privilege management vulnerability in the REST A…8.1
• CVE-2026-73270Improper Handling of Case Sensitivity vulnerability in Erlan…8.2
• CVE-2026-73273Gitea's Maven upload handler reads checksum uploads entirely…4.3
• CVE-2026-73276Gracefulness code ignored cases that should be rejected, res…8.3
• CVE-2026-7328Missing authorization in Caliptra Core Runtime Firmware (INV…6.8
• CVE-2026-73281In ssh-agent in OpenSSH before 10.5, some operations can occ…3.5
• CVE-2026-73282In ssh in OpenSSH before 10.5, a use-after-free for realloc …4.8
• CVE-2026-73283In sshd in OpenSSH before 10.5, the restrict keyword (in aut…2.5
• CVE-2026-73284RustFS is a distributed object storage system built in Rust.…8.8
• CVE-2026-73285RustFS is a distributed object storage system built in Rust.…7.5