GitLab has addressed multiple security flaws that could enable both two-factor authentication (2FA) bypass and denial-of-service (DoS) attacks in recent patch releases 18.8.2, 18.7.2, and 18.6.4 for Community Edition (CE) and Enterprise Edition (EE).
2FA bypass risk
A high-severity flaw tracked as CVE-2026-0723 stems from an unchecked return value in GitLab’s authentication services.
An attacker who already knows a victim’s credential ID could submit forged device responses to bypass 2FA and gain unauthorized access to GitLab accounts.
The issue affects GitLab CE/EE 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 and carries a CVSS score of 7.4.
GitLab also fixed several vulnerabilities that could allow remote denial-of-service attacks without authentication.
- CVE-2025-13927 (CVSS 7.5) affects the Jira Connect integration and allows crafted requests with malformed authentication data to exhaust resources.
- CVE-2025-13928 (CVSS 7.5) arises from an authorization issue in the Releases API and can be exploited to trigger service disruption.
- CVE-2026-1102 (CVSS 5.3) involves repeated malformed SSH authentication requests against an API endpoint, potentially impacting availability.
An additional medium-severity flaw, CVE-2025-13335 (CVSS 6.5), can cause an infinite loop via malformed Wiki redirects, allowing authenticated users to create a DoS condition.
| CVE ID | Severity | Issue type | CVSS | Affected versions (CE/EE) |
|---|---|---|---|---|
| CVE-2026-0723 | High | 2FA bypass (auth services) | 7.4 | 18.6 < 18.6.4; 18.7 < 18.7.2; 18.8 < 18.8.2 |
| CVE-2025-13927 | High | DoS – Jira Connect | 7.5 | 11.9–<18.6.4; 18.7 < 18.7.2; 18.8 < 18.8.2 |
| CVE-2025-13928 | High | DoS – Releases API | 7.5 | 17.7–<18.6.4; 18.7 < 18.7.2; 18.8 < 18.8.2 |
| CVE-2025-13335 | Medium | Infinite loop – Wiki redirect | 6.5 | 17.1–<18.6.4; 18.7 < 18.7.2; 18.8 < 18.8.2 |
| CVE-2026-1102 | Medium | DoS – SSH auth/API endpoint | 5.3 | 12.3–<18.6.4; 18.7 < 18.7.2; 18.8 < 18.8.2 |
GitLab has shipped fixes in versions 18.8.2, 18.7.2, and 18.6.4 and recommends that all self-managed instances upgrade immediately, while GitLab.com already runs the patched builds, and GitLab Dedicated requires no action.
Single-node deployments should expect downtime during database migrations, whereas multi-node environments can use zero‑downtime procedures, with 18.7.2 also including post-deploy migrations.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
.webp?fit=1600,900&ssl=1&description=Multiple+GitLab+Vulnerabilities+Enable+2FA+Bypass+and+Denial-of-Service+Attacks){kind=link}