CVE-2026-23603: Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
(updated )
When [oauth2_client] UPDATE_AVATAR = true is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go’s default HTTP client. The URL comes from the user’s OAuth/OIDC avatar value, commonly the OIDC picture claim.
The affected code path calls http.Get(url) without applying outbound host or IP restrictions. A low-privileged user who can influence their own picture claim under an already-configured OAuth2/OIDC source can cause the Gitea server to make arbitrary outbound HTTP GET requests. This includes requests to loopback addresses, RFC 1918 private network addresses, and IPv4 link-local addresses such as 169.254.169.254.
This is a blind SSRF by default. Impact can increase in deployments where the Gitea host can reach cloud metadata services, localhost-only services, or internal services that return valid image data.
References
- github.com/advisories/GHSA-x77v-q46j-393g
- github.com/go-gitea/gitea/commit/de4b8277e9cb576f2315fb03b5ab6478b42a1d31
- github.com/go-gitea/gitea/commit/f69e15afe7496cc62e96dab244629c69eb31a7bf
- github.com/go-gitea/gitea/pull/38406
- github.com/go-gitea/gitea/pull/38426
- github.com/go-gitea/gitea/releases/tag/v1.27.0
- github.com/go-gitea/gitea/security/advisories/GHSA-x77v-q46j-393g
- nvd.nist.gov/vuln/detail/CVE-2026-23603
Code Behaviors & Features
Detect and mitigate CVE-2026-23603 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →