Is CVE-2026-25946 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-25946?

CVE-2026-25946 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-25946

Description

When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can expose internal service behavior and enable interaction with resources that are not directly reachable by the attacker.