UpHeron
All vulnerabilities

Servers and applications

GHSA-vg9f-347r-pmqf

CSRF on OAuth Authorization Endpoint

Severity
Medium 5.4
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Cross-site request forgery (CWE-352)
Attack
Over the network · No login needed · Needs someone to click or open something
Attacker can
Read some data · Change some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Sources
Project advisories (GitHub)

Description

Gitea OAuth authorization endpoint lacks CSRF token validation and Origin checking, allowing an attacker to bind arbitrary Gitea accounts to victim's Dokploy instance.

  • File: apps/dokploy/pages/api/providers/gitea/authorize.ts:4-36
  • Function: handler (Next.js API route)

The /api/providers/gitea/authorize endpoint accepts a giteaId query parameter and immediately redirects the user to the Gitea OAuth authorization URL. There is no CSRF token generation or validation, no Origin/Referer header checking, and the state parameter is set to the Gitea provider ID rather than a random nonce. This allows an attacker to craft a malicious link that initiates OAuth flow for an attacker-controlled Gitea instance.

  • Preconditions: Victim must have a Dokploy session (be logged in)
  • Entry point: GET /api/providers/gitea/authorize?giteaId=VICTIM_ID&callbackUrl=http://evil.com
  • Target: Victim's Dokploy OAuth configuration
From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References