Vulnerability details
CVE-2022-51026
bytebase bytebase
Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login
CVSS 4.0
9.3Critical
Official description
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| bytebase | bytebase | 0.12.0 ≤ v < 1.0.1 | CVEProject cvelistV5 (CNA) |
References and advisories
7- https://github.com/bytebase/bytebase/security/advisories/GHSA-5r3p-6rj5-7937 vendor-advisory
- https://github.com/bytebase/bytebase/commit/d69e682243b25b51dd52912a26e2f259b5f3db2d patch
- https://github.com/bytebase/bytebase/pull/834 patchissue-tracking
- https://github.com/bytebase/bytebase/blob/1.0.0/server/auth.go#L79-L93 technical-description
- https://github.com/bytebase/bytebase/releases/tag/1.0.1 release-notes
- https://github.com/bytebase/bytebase product
- https://www.vulncheck.com/advisories/bytebase-0.12.0-before-1.0.1-authentication-bypass-via-gitlab-self-hosted-login third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-22
- Last updated
- 2026-10-29
- State
- Published
- Assigner (CNA)
- VulnCheck
- Kolun priority
- 26 · Low
Exploit prediction (EPSS)
0.61%
Probability of exploitation in 30 days
49.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-290Authentication Bypass by Spoofing