https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 10:30:20 +0000 https://vulnerability.circl.lu/vuln/cve-2026-23603 <p><strong>Affected:</strong> Gitea Open Source Git Server</p> <p>Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim</p> <p><strong>Affected:</strong> Gitea Open Source Git Server</p> <p>Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim</p> https://vulnerability.circl.lu/vuln/cve-2026-23603 https://vulnerability.circl.lu/vuln/ghsa-x77v-q46j-393g <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary When `[oauth2_client] UPDATE_AVATAR = true` is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go&#39;s default HTTP client. The URL comes from the user&#39;s OAuth/OIDC avatar value, commonly the OIDC `picture` claim.</p> <p>The affected code path calls `http.Get(url)` without applying outbound host or IP restrictions. A low-privileged user who can influence their own `picture` claim under an already-configured OAuth2/OIDC source can cause the Gitea server to make arbitrary outbound HTTP GET requests. This includes requests to loopback addresses, RFC 1918 private network addresses, and IPv4 link-local addresses such as `169.254.169.254`.</p> <p>This is a blind SSRF by default. Impact can increase in deployments where the Gitea host can reach cloud metadata services, localhost-only services, or internal services that return valid image data.</p> <p>### Details The vulnerable sink is in `routers/web/auth/oauth.go`:</p> <p>```go func oauth2UpdateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) { if setting.OAuth2Client.UpdateAvatar &amp;&amp; len(url) &gt; 0 { resp, err := http.Get(url) if err == nil { defer func() { _ = resp.Body.Close() }() } if err == nil &amp;&amp; resp.StatusCode == http.StatusOK { data, err := io.ReadAll(io.LimitReader(resp.Body, setting.Avatar.MaxFileSize+1)) if err == nil &amp;&amp; int64(len(data)) &lt;= setting.Avatar.MaxFileSize { _ = user_service.UploadAvatar(…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary When `[oauth2_client] UPDATE_AVATAR = true` is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go&#39;s default HTTP client. The URL comes from the user&#39;s OAuth/OIDC avatar value, commonly the OIDC `picture` claim.</p> <p>The affected code path calls `http.Get(url)` without applying outbound host or IP restrictions. A low-privileged user who can influence their own `picture` claim under an already-configured OAuth2/OIDC source can cause the Gitea server to make arbitrary outbound HTTP GET requests. This includes requests to loopback addresses, RFC 1918 private network addresses, and IPv4 link-local addresses such as `169.254.169.254`.</p> <p>This is a blind SSRF by default. Impact can increase in deployments where the Gitea host can reach cloud metadata services, localhost-only services, or internal services that return valid image data.</p> <p>### Details The vulnerable sink is in `routers/web/auth/oauth.go`:</p> <p>```go func oauth2UpdateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) { if setting.OAuth2Client.UpdateAvatar &amp;&amp; len(url) &gt; 0 { resp, err := http.Get(url) if err == nil { defer func() { _ = resp.Body.Close() }() } if err == nil &amp;&amp; resp.StatusCode == http.StatusOK { data, err := io.ReadAll(io.LimitReader(resp.Body, setting.Avatar.MaxFileSize+1)) if err == nil &amp;&amp; int64(len(data)) &lt;= setting.Avatar.MaxFileSize { _ = user_service.UploadAvatar(…</p> https://vulnerability.circl.lu/vuln/ghsa-x77v-q46j-393g