Forgejo CVE-2026-119545

The OpenID sign-in feature must be enabled on the Forgejo instance - the GHSA advisory states the /user/login/openid discovery path fetches the user-supplied provider URL server-side via openid-go/http.DefaultClient with no hostmatcher, no IP filter, no CSRF and no authentication only 'when OpenID sign-in is enabled.' OpenID sign-in is not enabled by default, so this is the primary limiting factor: instances without it are not exposed via this vector. Where it is enabled, no authentication or user interaction is required (PR:N/UI:N), the endpoint is reachable by any remote attacker over the network, and affected versions are Forgejo through 15.0.11, 16.0.0-16.0.7, and 17.0.0-17.0.1. The impact is further limited by the SSRF being blind (discovery GET requests), suited to port scanning and probing of loopback, cloud metadata, and internal addresses rather than wholesale retrieval of internal responses.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 6.9, MEDIUM) describes an unauthenticated, network-reachable, low-complexity SSRF whose only direct impact is low confidentiality - consistent with the description's 'blind discovery GET requests' used for port scanning and probing rather than full response exfiltration. The vuln.today Decision label is this_month, not act_now or emergency, which matches a medium-severity blind SSRF. No EPSS score and no CISA KEV status were provided in the input, so exploitation probability and active-exploitation signals cannot be weighed; absence here is not evidence of safety but should not be read as active exploitation either. A key limiting factor tempers the AV:N/PR:N reading: the GHSA advisory states the OpenID discovery path is only reachable 'when OpenID sign-in is enabled,' which is not the default configuration, so the unauthenticated-internet exposure applies only to instances that have turned the feature on. Net assessment: a genuine but config-gated, mostly-blind SSRF - a real but non-emergency priority for operators who have OpenID sign-in enabled, lower priority for those who do not. Note: the formal severity is MEDIUM, so this is not a high-CVSS item; its interest comes from being unauthenticated on exposed, OpenID-enabled instances.

An attacker on the internet sends a crafted POST to /user/login/openid on a Forgejo instance that has OpenID sign-in enabled, supplying an arbitrary OpenID identifier URL pointing at a loopback, cloud metadata (e.g. 169.254.169.254), or internal RFC1918/CGNAT address. The server-side OpenID discovery logic then issues a blind GET request to that target, letting the attacker infer which internal hosts and ports respond, for reconnaissance of the internal network. The attack is unauthenticated and low-complexity per the CVSS vector; a public PoC reference exists (abraxaslabs research write-up and the upstream GHSA, which bundles a run_poc.sh), though it is not confirmed in the input as verified working exploit code for this specific Forgejo path.