Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🚨 CVE-2026-73278 (CVSS 9.8 Critical)OAuth2 and OIDC sign-in paths in Gitea fail to enforce WebAuthn challenges, allowing attackers authenticating via external IdP to bypass 2FA and hijack victim accounts.https://www.thehackerwire.com/vulnerability/CVE-2026-73278/ https://t.co/GkhC7xOyR0
Unpatched vulnerabilities don't stay hidden on our atlas. #CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2026-73278 Vendor → Unknown Severity → Critical — CVSS 9.8 Product → Unknown Date → 2026-10-06 A critical vulnerability (Improper Authentication) has been disclosed affecting Unknown. Patch immediately. Powered by @Brandefense #ThreatIntel #CyberSecurity #CVE #Unknown