OAuth2

Security incidents tagged OAuth2. Newest first.

1 OAuth2 incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Patched
Gitea 28.3.0 security release: OAuth2 account-linking takeover and Actions/token fixes
Gitea 28.3.0 (third maintenance release of the 28 series) ships a large security batch. CVE-2026-120263: when ACCOUNT_LINKING=auto and registration is enabled, the link-account sign-up form looked up the account to link by attacker-submitted username/email instead of the OAuth2 identity, allowing passwordless takeover of existing accounts. The release also fixes high-severity Actions issues (fork workflows obtaining secrets/write tokens via review commit_id; Actions task tokens authenticating to the REST API without scope), stored XSS via artifact Content-Encoding, write-collaborator release/milestone/label destruction on archived repos, and additional medium issues around token scopes. Gitea strongly recommends upgrading ASAP. Fixed in 28.3.0.
GiteaSince Nov 1, 2026updated Nov 6, 2026, 16:19 UTC