HIGH
CVE-2026-0723
CVSS
7.4
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an individual with existing knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses.
Summary dbcve.org
Two-factor authentication bypass vulnerability in GitLab CE/EE where an attacker with knowledge of a victim's credential ID could submit forged device responses to bypass 2FA authentication across affected versions 18.6.x before 18.6.4, 18.7.x before 18.7.2, and 18.8.x before 18.8.2.
Mitigation
Upgrade GitLab to version 18.6.4, 18.7.2, 18.8.2 or later to remediate the 2FA bypass vulnerability.
Weakness (CWE)
CWE-252
EPSS Score
0.87%
Probability of exploitation in next 30 days
57.1th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.