CVE-2022-51026

Summary

Bytebase versions before 1.0.1 contain an authentication bypass in the GitLab self-hosted login endpoint (POST /api/auth/login/GITLAB_SELF_HOST) where an attacker can supply a malicious GitLab instance URL, causing Bytebase to authenticate them as any user by controlling the identity provider response.

Exploitability

Exploitation is trivial for remote attackers with network access to the vulnerable endpoint; no authentication or user interaction is required.

Blast radius

Successful exploitation allows full account takeover of existing users—including Owners—and enables creation of new privileged accounts, leading to complete system compromise and data breach.

Detection

Defenders should monitor for POST requests to /api/auth/login/GITLAB_SELF_HOST with non-whitelisted or newly registered GitLab instance URLs in logs; anomalous session creation events for users not previously present in the system may also indicate exploitation.

Prioritized remediation

Upgrade to Bytebase version 1.0.1 or later, which fixes the vulnerability by validating and restricting the GitLab instance URL to trusted domains.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.