PUBLISHED
2026-08-13 17:17
MODIFIED
2026-08-13 17:17
EPSS (Prob. Exploit)
0.29%
Top 79.5%
> DESCRIPTION
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-918: Server-Side Request Forgery - The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
> GITHUB SECURITY ADVISORY
GHSA-x77v-q46j-393g
LOW
Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
AFFECTED PACKAGES:
GO / code.gitea.io/gitea
< 1.27.0
Fixed in: 1.27.0
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
AFFECTED PACKAGES:
Unknown / Unknown
38 versions affected
ALIASES:
GHSA-x77v-q46j-393g, GO-2026-6083
> HISTORIQUE DES MODIFICATIONS
Première apparition
13/08/2026 17:17
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-918: Server-Side Request Forgery (SSRF) - The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure th...
Nouvelle valeur:
CWE-918: Server-Side Request Forgery - The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the ...
📊
ENRICHISSEMENT
01/09/2026 06:02
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-918: Server-Side Request Forgery (SSRF) - The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure th...
Total des modifications: 2
Dernière mise à jour: 4 hours ago