Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

GitLab Security Flaws Could Allow Two-Factor Authentication Bypass and DoS

GitLab has issued critical security patches to address vulnerabilities in both the Community Edition (CE) and Enterprise Edition (EE). The updates apply to versions 18.8.2, 18.7.2, and 18.6.4, designed to remedy issues including a two-factor…

EBy Eric WallaceJan 21, 20262 min read

GitLab has issued critical security patches to address vulnerabilities in both the Community Edition (CE) and Enterprise Edition (EE). The updates apply to versions 18.8.2, 18.7.2, and 18.6.4, designed to remedy issues including a two-factor authentication bypass and denial-of-service attacks. It is strongly advised that all self-managed installations upgrade immediately, while GitLab.com users already have the patches deployed.

Critical Authentication Bypass Vulnerability

The most critical vulnerability, identified as CVE-2026-0723, involves an unchecked return value in authentication services, allowing attackers to bypass two-factor authentication using forged device responses. This vulnerability, with a CVSS score of 7.4, affects GitLab versions from 18.6 to 18.8.1, posing significant security risks to user accounts.

CVE ID Vulnerability CVSS Score Severity

CVE-2026-0723 Unchecked Return Value in authentication services (2FA bypass) 7.4 High

CVE-2025-13927 Denial of Service in Jira Connect integration 7.5 High

CVE-2025-13928 Incorrect Authorization in Releases API 7.5 High

GitLab has issued critical security patches to address vulnerabilities in both the Community Edition (CE) and Enterprise Edition (EE).
Eric Wallace · Thehackingpost

CVE-2025-13335 Infinite Loop in Wiki redirects 6.5 Medium

CVE-2026-1102 Denial of Service in API endpoint (SSH requests) 5.3 Medium

Security researcher ahacker1 discovered and reported the flaw through GitLab's HackerOne bug bounty program. Organizations utilizing two-factor authentication for high-privilege accounts should prioritize this patch.

GitLab has also resolved three denial-of-service vulnerabilities:

Advertisement

CVE-2025-13927: Allows attackers to crash GitLab instances through malformed requests to the Jira Connect integration, existing since version 11.9, with a CVSS score of 7.5. CVE-2025-13928: Involves incorrect authorization validation in the Releases API, affecting versions 17.7 and later, allowing unauthenticated users to cause disruptions. CVE-2026-1102: Discovered internally, this flaw impacts versions since 12.3, causing denial-of-service through repeated malformed SSH authentication requests, rated with a 5.3 CVSS score.

Additionally, CVE-2025-13335 addresses an infinite loop issue in Wiki redirects, allowing authenticated users to create documents that bypass cycle detection and cause service disruptions. GitLab emphasizes the need for immediate upgrades to the latest patch for all self-managed installations.

Single-node setups will experience downtime during migration, while multi-node installations can implement zero-downtime upgrades. GitLab's disclosure policy releases vulnerability details 30 days post-patch to ensure organizations have time to secure systems.

Based on reporting by GBHackers.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026