GitLab recently addressed a high-severity security flaw that allowed attackers to bypass two-factor authentication in both Community and Enterprise editions. By exploiting a weakness in how the platform verifies device responses, individuals with a target's account ID could gain unauthorized access, though patches are now available in the latest software versions.
GitLab has issued emergency security updates to resolve a critical vulnerability, identified as CVE-2026-0723, which compromised the integrity of its two-factor authentication system. This specific flaw originated from an unchecked return value within the platform's authentication services. If an attacker managed to obtain a user's credential ID, they could submit forged device responses to successfully circumvent the secondary security layer and access private accounts.
Beyond the authentication bypass, the company addressed two other high-severity vulnerabilities that posed a risk of denial-of-service attacks. These flaws, tracked as CVE-2025-13927 and CVE-2025-13928, could allow unauthenticated users to crash services by sending specifically crafted requests with malformed data or exploiting validation errors in API endpoints. These issues threatened the availability of self-managed GitLab instances by allowing remote actors to disrupt operations without needing valid login credentials.
The security release also included fixes for two medium-severity denial-of-service vulnerabilities. One issue involved the bypass of cycle detection within Wiki documents, while the other involved a flood of malformed SSH authentication requests. While these were deemed less critical than the authentication bypass, they still presented significant risks for administrators managing large-scale development environments where uptime is essential for production.
To mitigate these risks, GitLab has released versions 18.8.2, 18.7.2, and 18.6.4. The company has urged all administrators of self-managed installations to upgrade to these versions immediately to protect their data. While GitLab.com and GitLab Dedicated environments have already been secured by the company's internal teams, those running their own servers remain vulnerable until the manual update is performed.
The urgency of these patches is underscored by the high visibility of GitLab instances on the public internet. Security monitors like Shadowserver and Shodan have identified tens of thousands of exposed devices globally that could be targeted by threat actors. With nearly 6,000 instances specifically flagged as vulnerable Community Edition installations, the window for exploitation remains open for any organization that delays the transition to the patched software.
Source: GitLab Warns Of High Severity Two Factor Bypass And Service Disruption Flaws