01 Record

CVE-2026-23603

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

LowPUBLISHEDCNA: Gitea

Base score3.1 CVSS v3.xCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

02 Description

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Published: 2026-08-13 16:44Z1 DAY AGO
Last updated: 2026-08-14 17:45Z1 HR AGO
Reserved: 2026-03-03
Assigning CNA: Gitea
Record state: PUBLISHED
Severity: Low (CVSS 3.1)
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses: CWE-918
SSVC decision: ExploitationpocAutomatablenoTechnical Impactpartial
Data version: 5.2
Document digest: 31a500f9e1eee12187515beba4f928dc7d568eaae41974e0222bea73180a62cf

VendorProductVersionsPlatforms