security
Gitea 28.2.0 patches 12 CVEs, headlined by an OpenID account takeover
Gitea 28.2.0 ships twelve CVE fixes, led by a High-severity OpenID 2.0 flaw that let an attacker-controlled provider attach its identity to a victim's account and sign in as them, bypassing the local TOTP and WebAuthn checks.