https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 15:16:02 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-15781 bdu:2026-15781 https://cve.radiocsirt.org/vuln/bdu:2026-15781 https://cve.radiocsirt.org/vuln/euvd-2026-352807 EUVD-2026-352807 https://cve.radiocsirt.org/vuln/euvd-2026-352807 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23603 <p>Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim</p> <p>Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23603 https://cve.radiocsirt.org/vuln/ghsa-x77v-q46j-393g <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary When `[oauth2_client] UPDATE_AVATAR = true` is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go&#39;s default HTTP client. The URL comes from the user&#39;s OAuth/OIDC avatar value, commonly the OIDC `picture` claim.</p> <p>The affected code path calls `http.Get(url)` without applying outbound host or IP restrictions. A low-privileged user who can influence their own `picture` claim under an already-configured OAuth2/OIDC source can cause the Gitea server to make arbitrary outbound HTTP GET requests. This includes requests to loopback addresses, RFC 1918 private network addresses, and IPv4 link-local addresses such as `169.254.169.254`.</p> <p>This is a blind SSRF by default. Impact can increase in deployments where the Gitea host can reach cloud metadata services, localhost-only services, or internal services that return valid image data.</p> <p>### Details The vulnerable sink is in `routers/web/auth/oauth.go`:</p> <p>```go func oauth2UpdateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) { if setting.OAuth2Client.UpdateAvatar &amp;&amp; len(url) &gt; 0 { resp, err := http.Get(url) if err == nil { defer func() { _ = resp.Body.Close() }() } if err == nil &amp;&amp; resp.StatusCode == http.StatusOK { data, err := io.ReadAll(io.LimitReader(resp.Body, setting.Avatar.MaxFileSize+1)) if err == nil &amp;&amp; int64(len(data)) &lt;= setting.Avatar.MaxFileSize { _ = user_service.UploadAvatar(…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary When `[oauth2_client] UPDATE_AVATAR = true` is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go&#39;s default HTTP client. The URL comes from the user&#39;s OAuth/OIDC avatar value, commonly the OIDC `picture` claim.</p> <p>The affected code path calls `http.Get(url)` without applying outbound host or IP restrictions. A low-privileged user who can influence their own `picture` claim under an already-configured OAuth2/OIDC source can cause the Gitea server to make arbitrary outbound HTTP GET requests. This includes requests to loopback addresses, RFC 1918 private network addresses, and IPv4 link-local addresses such as `169.254.169.254`.</p> <p>This is a blind SSRF by default. Impact can increase in deployments where the Gitea host can reach cloud metadata services, localhost-only services, or internal services that return valid image data.</p> <p>### Details The vulnerable sink is in `routers/web/auth/oauth.go`:</p> <p>```go func oauth2UpdateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) { if setting.OAuth2Client.UpdateAvatar &amp;&amp; len(url) &gt; 0 { resp, err := http.Get(url) if err == nil { defer func() { _ = resp.Body.Close() }() } if err == nil &amp;&amp; resp.StatusCode == http.StatusOK { data, err := io.ReadAll(io.LimitReader(resp.Body, setting.Avatar.MaxFileSize+1)) if err == nil &amp;&amp; int64(len(data)) &lt;= setting.Avatar.MaxFileSize { _ = user_service.UploadAvatar(…</p> https://cve.radiocsirt.org/vuln/ghsa-x77v-q46j-393g https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304