Critical 9.8Published Oct 22, 2026

CVE-2022-51026Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login

Updated under an hour ago (Oct 28, 2026, 8:10 PM ET)

Does this affect you?

It affects bytebase. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.61%, higher than 49% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for bytebase

Exploited in the last 30 days

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-290
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.61% (percentile 49)
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 22, 2026
First seen by InfoSec Signals: Oct 22, 2026

Affected products

Affected products

bytebase bytebase bytebase:bytebase (from the name)	from 0.12.0 before 1.0.1; 1.0.1 not affected	CNA record

References

References

https://github.com/bytebase/bytebase/security/advisories/GHSA-5r3p-6rj5-7937	vendor-advisory
https://github.com/bytebase/bytebase/commit/d69e682243b25b51dd52912a26e2f259b5f3db2d	patch
https://github.com/bytebase/bytebase/pull/834	patch, issue-tracking
https://github.com/bytebase/bytebase/blob/1.0.0/server/auth.go#L79-L93	technical-description
https://github.com/bytebase/bytebase/releases/tag/1.0.1	release-notes
https://github.com/bytebase/bytebase	product
https://www.vulncheck.com/advisories/bytebase-0.12.0-before-1.0.1-authentication-bypass-via-gitlab-self-hosted-login	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.