The OAuth2 sign-in callback endpoint in Gitea 1.26.1 improperly handles the local user's active status. Specifically, if the local account is disabled (IsActive=false), the callback forcibly sets the account to active (IsActive=true) before updating the user record and issuing a session. This behavior effectively negates any administrator-initiated disable action once the user authenticates through a linked external identity provider. The root cause is that the callback treats the local active flag as non-authoritative bookkeeping rather than an administrative override, unlike the local credential sign-in path which correctly enforces the inactive state.

An attacker with a linked external identity provider can bypass the administrator's disable account action by completing the OAuth sign-in callback, thereby re-enabling their account without administrator intervention. This grants the user full access to their repositories, organizations, and access tokens, defeating the primary short-term remediation method for compromised or deprovisioned accounts in Gitea deployments using SSO.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be aware that disabling accounts is ineffective for users with linked external identity providers. Alternative incident response measures should be considered, such as revoking access at the identity provider level or restricting OAuth authentication sources. Monitor vendor communications for updates and apply patches promptly once released.