CVE-2026-73278

Executive Summary

CVE-2026-73278 is an authentication bypass vulnerability (CWE-287, Improper Authentication) in Gitea's OAuth2 and OpenID Connect (OIDC) sign-in paths. When WebAuthn is the only configured second factor on an account, the external identity flows fail to require the WebAuthn challenge that is enforced during normal password login, allowing a party who can authenticate through the affected external identity flow to obtain a full session without passkey verification. At least one affected path can additionally persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario. The vulnerability is currently unpatched with no CVSS score or EPSS score assigned and no public proof-of-concept available.

Technical Analysis

The core defect is an inconsistency in how Gitea enforces multi-factor authentication across different authentication entry points. Gitea supports two primary interactive authentication paths: a local password login and external identity flows via OAuth2 and OpenID Connect. When an account has WebAuthn configured as its sole second factor (i.e., no TOTP), the password login path requires a successful WebAuthn challenge before a session is issued. According to the NVD description, the OAuth2 and OpenID Connect sign-in paths do not enforce this same WebAuthn challenge.

This is a classic instance of CWE-287, Improper Authentication: the application implements authentication correctly on one code path but omits a required verification step on parallel code paths that should be equivalent in assurance. The security control — the WebAuthn challenge — is bound to the password authentication flow rather than to the account's overall authentication policy, so any flow that bypasses the password flow also bypasses the second factor.

Two distinct consequences are described. First, a party able to authenticate through the affected external identity flow obtains a full Gitea session without the passkey verification that the password login would have demanded. The precondition is that the attacker can successfully authenticate to the external identity provider (or otherwise satisfy that flow) for an account whose only configured second factor is WebAuthn. Second, at least one affected path can persist an external identity link. Because the external identity link is a durable association between the external identity and the Gitea account, the compromise is not confined to a single session; the link survives beyond the initial session and can serve as a persistent foothold for re-authentication.

The vulnerability class is authentication logic/flow inconsistency. No specific function names, endpoints, parameters, or file paths are provided in the NVD description, so implementation-level detail beyond what is stated cannot be asserted. The reported scope is explicitly limited to accounts where WebAuthn is the only configured second factor; accounts with TOTP configured are stated to be outside this scenario, which indicates the flaw is specific to WebAuthn-only enforcement on the external identity flows rather than a general MFA bypass for all second-factor types.

Exploitation Scenarios

Precondition: the target is a Gitea instance that exposes OAuth2 and/or OpenID Connect sign-in, and the victim account has WebAuthn configured as its only second factor. No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Gitea instance that offers external identity sign-in (OAuth2/OIDC) and enumerates accounts of interest. Because WebAuthn-only accounts are the affected population, the attacker also needs knowledge or inference that the target account relies solely on WebAuthn as a second factor. This can be established through prior reconnaissance, insider knowledge, or by observing that password-based login for the account is gated by a WebAuthn challenge while no TOTP prompt appears.

2. Triggering the flawed flow. Rather than authenticating through the password login path (which enforces the WebAuthn challenge), the attacker initiates the OAuth2 or OpenID Connect sign-in path. The attacker completes the external identity flow — meaning the attacker can authenticate through the affected external identity flow (e.g., controls or can satisfy the external identity provider account, or has obtained the external credentials by other means). At this point, the described defect is triggered: the sign-in path does not present or require the WebAuthn challenge even though WebAuthn is the account's only second factor.

3. Session issuance / payload execution method at the vulnerability-class level. On completion of the external identity flow, Gitea issues a full authenticated session without the passkey verification that the password login path would have required. No injection payload, memory corruption primitive, or crafted request is needed; the "exploit" is the legitimate use of the external identity flow against an account whose step-up control is bypassed. The WebAuthn check is omitted rather than subverted.

4. Post-exploitation impact and persistence. With the session established, the attacker operates as the victim user within Gitea, subject to that user's privileges (repository access, organization membership, administrative capabilities if the account holds them). Additionally, at least one affected path can persist an external identity link, meaning the attacker can bind an external identity to the Gitea account so the association outlives the initial session. This converts an ephemeral session theft into a durable compromise mechanism that can be re-used to regain access after the initial session expires or is revoked. Accounts with TOTP configured are outside this reported scenario, so the attack is specifically applicable to the WebAuthn-only population.

Impact Assessment

The impact is full account compromise for affected accounts. Because the bypass yields a "full session" without the intended passkey verification, the attacker inherits all authorization associated with the victim account: access to private repositories, code, issues, secrets that may be stored in Gitea, organization and team memberships, and any administrative functions the account can invoke. The CIA triad is best characterized as high confidentiality and high integrity impact, with limited direct availability impact, consistent with the assigned vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Note that no CVSS score has been officially assigned by NVD (score: N/A) and the vector above is an analytical estimate rather than a vendor-published value. The CNA did not provide a title, and NVD did not provide versions, so the precise affected release range is unknown.

The blast radius is bounded by the population of accounts that use WebAuthn as their only second factor, but the persistence property (external identity link) amplifies the severity for those accounts: even after an administrator revokes sessions or forces reauthentication, the persisted link may permit the attacker to re-enter through the same external identity flow. For organizations that treat WebAuthn as their strongest factor and rely on it for privileged or administrative accounts, this vulnerability undermines that assurance guarantee specifically on the OAuth2/OIDC paths. The vulnerability is currently unpatched (patch confidence 0/4), unlisted in CISA KEV, and has no assigned EPSS score; there is no evidence of in-the-wild exploitation at the time of writing, but the absence of a patch raises the value of compensating controls.

Detection Guidance

Sigma Rule

title: Gitea OAuth2/OIDC Sign-In Without WebAuthn Step-Up (WebAuthn-Only Accounts)
id: 8f2c1a44-6b7e-4c9a-9d21-73278cve0001
status: experimental
description: Detects successful Gitea authentication via OAuth2/OIDC for accounts whose only second factor is WebAuthn, where no WebAuthn challenge was recorded. Intended for correlation with identity-provider and Gitea audit logs.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73278
author: valtersit.com
date: 2026/01/01
logsource:
  product: gitea
  service: audit
detection:
  selection_auth:
    action:
      - 'oauth2_signin'
      - 'openid_signin'
      - 'sign_in'
  selection_webauthn_absent:
    webauthn_challenge: false
  filter_totp_present:
    second_factor: 'totp'
  condition: selection_auth and selection_webauthn_absent and not filter_totp_present
fields:
  - user
  - ip_address
  - action
  - external_identity
falsepositives:
  - Users who legitimately have no second factor configured
  - Accounts migrated with second-factor state not yet synchronized in logs
level: high

YARA Rule

rule CVE_2026_73278_Gitea_OAuth_WebAuthn_Bypass
{
    meta:
        description = "Heuristic detection of Gitea OAuth2/OIDC authentication handling that omits WebAuthn step-up for WebAuthn-only accounts (CVE-2026-73278)."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73278"
        date = "2026-01-01"
        severity = "high"

    strings:
        $gitea_marker1 = "Gitea" ascii wide
        $oauth_marker1  = "oauth2" ascii nocase
        $oidc_marker1   = "openid" ascii nocase
        $webauthn1      = "webauthn" ascii nocase
        $webauthn2      = "WebAuthn" ascii wide
        $signin1        = "sign_in" ascii nocase
        $signin2        = "signin" ascii nocase
        $totp1          = "totp" ascii nocase

    condition:
        uint32(0) == 0x464c457f or uint32(0) == 0xfeedface or uint32(0) == 0xcafebabe
        and filesize > 1MB
        and $gitea_marker1
        and ($oauth_marker1 or $oidc_marker1)
        and ($webauthn1 or $webauthn2)
        and ($signin1 or $signin2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73278 Gitea OAuth2/OIDC Sign-In Likely Authentication Bypass (WebAuthn-only account)"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"login"; nocase; http.uri; content:"oauth"; nocase; http.host; content:"gitea"; nocase; threshold:type limit, track by_src, count 3, seconds 60; classtype:attempted-user; sid:202673278; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_73278, vendor Gitea;)

Elastic Detection

sequence by user.name, source.ip with maxspan=2m
  [ authentication where event.outcome == "success"
    and event.action in ("oauth2_signin", "openid_signin", "user_signin") ]
  [ authentication where event.outcome == "success"
    and not event.action in ("webauthn_authenticate", "user_second_factor") ]

Splunk SPL Query

index=gitea sourcetype=gitea:audit (action="oauth2_signin" OR action="openid_signin" OR action="sign_in")
| eval sf_present=if(isnotnull(second_factor) AND second_factor!="",1,0)
| eval totp_present=if(second_factor="totp",1,0)
| where (sf_present=0 OR webauthn_challenge="false") AND totp_present=0
| stats count min(_time) as first_seen max(_time) as last_seen values(action) as actions by user ip_address external_identity
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| table user ip_address external_identity actions count first_seen last_seen

Wazuh OSSEC Rule

<group name="gitea,authentication,cve-2026-73278,">
  <rule id="202678" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">oauth2_signin|openid_signin|sign_in</field>
    <field name="outcome">success</field>
    <description>CVE-2026-73278: Gitea external identity sign-in succeeded without WebAuthn step-up - possible authentication bypass on WebAuthn-only account.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data has been published in any tracked source, so the guidance below is compensating-control based.

1. Immediate mitigations. Until a vendor fix is available, reduce exposure by treating the OAuth2/OIDC second-factor gap as an active risk. Organizations with privileged Gitea accounts protected solely by WebAuthn should temporarily add TOTP as a second factor on those accounts, because the NVD description explicitly places TOTP-configured accounts outside the reported WebAuthn-only scenario. Where possible, restrict or disable external identity sign-in for sensitive accounts or deployments until the flows enforce WebAuthn. Enforce network-level controls (VPN, IP allowlisting, SSO gateway) so that the external identity flow is not reachable by unauthenticated or untrusted parties, and tightly control which external identity providers are trusted for sign-in. Monitor and periodically audit persisted external identity links for associations that were not intentionally created, and remove unexpected links.

2. Patch / upgrade steps. No patched version is available. Monitor the Gitea project's security advisories, release notes, and repository for a fix, and apply it immediately upon release. Because no affected version range has been published, validation of any future fix should include regression testing of both the password login and the OAuth2/OIDC sign-in paths against WebAuthn-only accounts to confirm that the challenge is now enforced uniformly across all entry points.

3. Long-term hardening. Adopt defense-in-depth so that second-factor enforcement is bound to the account's authentication policy rather than to individual login code paths — this reduces the class of bug represented by CWE-287 in multi-flow authentication systems. Require phishing-resistant MFA plus a secondary factor for high-value accounts and avoid WebAuthn-only configurations for administrative identities until the flows are verified. Centralize and correlate authentication audit logs from both the identity provider and Gitea, alert on external-identity sign-ins that lack a corresponding WebAuthn event, and establish a formal process to review and expire external identity links. Track CVE-2026-73278 in the vulnerability management program and re-assess risk as CVSS, EPSS, KEV, and patch data become available.

References

• NVD — CVE-2026-73278: https://nvd.nist.gov/vuln/detail/CVE-2026-73278
• CWE-287: Improper Authentication — https://cwe.mitre.org/data/definitions/287.html
• Gitea project security advisories and releases: https://github.com/go-gitea/gitea/releases
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-73278 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score yet assigned for this CVE): https://www.first.org/epss/

No public proof-of-concept, no Nuclei template, and no exploit code are available for CVE-2026-73278. There is currently no evidence of exploitation in the wild and no known threat actor campaign associated with this vulnerability. CVSS and EPSS scores have not been assigned at the time of writing.