CVE-2026-119545 Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery

Medium 6.9 Published 30 Oct 2026 Updated 30 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-119545?

CVE-2026-119545 is a medium-severity vulnerability in forgejo, published on 30 Oct 2026.

Official description

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers can POST crafted identifiers to /user/login/openid to trigger blind discovery GET requests to loopback, cloud metadata, and internal addresses for port scanning and probing.

Weakness: CWE-918

Which versions are affected by CVE-2026-119545?

How do I fix CVE-2026-119545?

No fix has been published for CVE-2026-119545 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119545 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119545 exists.

Sources

Also known as GHSA-877c-6q9f-v4cw.