Forgejo has published a notice saying it will remove support for OpenID Authentication 2.0, and the release that removes it is v19, scheduled for 25 March 2027. The notice is dated 2 November 2026 and runs to a few sentences, so the story is a date and a release track. There is no CVE here and no vulnerability described.
“Forgejo will be removing support for the OpenID Authentication 2.0 standard for authenticating users.” That is the entire change, and it is scoped to signing in.
Your track decides your date
“The last releases to support OpenID Authentication 2.0 will be:” the notice says, and then splits the answer by how you install.
On the long-term-support track, “the current Forgejo v15 LTS will be the last release to maintain support”, which the notice puts at supported until v15’s end of life on 15 July 2027.
On the stable track, “the current stable release Forgejo v17, and the next stable release Forgejo v18 will maintain support”, and stable installations are supported until v18’s end of life on 29 April 2027. We covered v17.0 when it landed on 15 October.
Read the two dates against the removal date and a gap shows up. v19 arrives on 25 March 2027, five weeks before v18 reaches the end of its support on 29 April 2027. The notice states both facts and does not say what a stable installation should do inside that window. Nothing here fills that in.
What stays
“Note that OpenID Connect (OIDC), and OAuth are unrelated technologies that remain supported.” The notice separates them explicitly, so a setup that signs people in through OIDC or OAuth is not covered by this removal.
What the notice does not say
It gives no CVE, no vulnerability and no suggestion that OpenID 2.0 is insecure. The post is filed under news and security on the project site, but its own text supplies no security reason for the change. It closes by pointing at “the related discussion and reasoning”, which is where the project’s argument lives; that thread was not part of this note, so it is not summarised here. The notice also says nothing about what becomes of existing OpenID 2.0 links or accounts after v19.
Who has work to do
If your instance signs people in with local accounts only, this changes nothing for you. If anyone authenticates through an OpenID 2.0 identity, the notice is your deadline: the last release that supports it on your track, then move those users to one of the methods the notice names as supported. No setup steps or configuration keys appear here, because Forgejo’s authentication documentation was not part of this note, and a guessed key would be worse than the gap.
Source: the Forgejo notice, dated 2 November 2026.