CVE-2022-51026

CRITICAL 9.8

Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.

CWE	CWE-290
Vendor	bytebase
Product	bytebase
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for bytebase bytebase

Be the first to know when new critical vulnerabilities affecting bytebase bytebase are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

bytebase / bytebase

0.12.0 < 1.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/bytebase/bytebase/security/advisories/GHSA-5r3p-6rj5-7937 github.com: https://github.com/bytebase/bytebase/commit/d69e682243b25b51dd52912a26e2f259b5f3db2d github.com: https://github.com/bytebase/bytebase/pull/834 github.com: https://github.com/bytebase/bytebase/blob/1.0.0/server/auth.go#L79-L93 github.com: https://github.com/bytebase/bytebase/releases/tag/1.0.1 github.com: https://github.com/bytebase/bytebase vulncheck.com: https://www.vulncheck.com/advisories/bytebase-0.12.0-before-1.0.1-authentication-bypass-via-gitlab-self-hosted-login

Credits

🔍 leediay153 from Viettel Post