Bytebase: Authentication bypass via GitLab self-hosted login
Summary
Bytebase, a database governance platform, trusts a client-supplied GitLab instance URL in its GitLab self-hosted login endpoint. An unauthenticated attacker can point this URL to a server they control, which returns a chosen active user email, and then receive valid session tokens. This allows login as any existing user, including the Owner, or creating new members.
Affected
- Bytebase 0.12.0 to before 1.0.1
- Some advisory data also lists versions up to and including 1.0.0; treat all versions below 1.0.1 as vulnerable until the vendor clarifies.
Fixed in
- Bytebase 1.0.1
Workaround
Unknown.
Exploitation
- Automatable: yes (CISA SSVC)
- Known exploited: no evidence found
- Public proof of concept: none found; VulDB reports technical details are known but no exploit is available
Our recommendation
- Upgrade Bytebase to version 1.0.1 or later immediately.
- Restrict access to the Bytebase web/API port to staff networks or VPN until patched.
- After upgrading, review Owner and user accounts and recent membership changes for unknown or new members.
- Rotate credentials and restart the server after patching, as derived tokens may remain valid until a reboot.
- Check logs for logins through the GITLAB_SELF_HOST path from unexpected sources.
- If the instance is internet-facing, treat it as critical and patch or take it offline first.
- Check whether Bytebase is in use at all.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Bytebase security advisory GHSA-5r3p-6rj5-7937 github.com
- Bytebase release 1.0.1 github.com
- Fix commit d69e682 github.com
- Bytebase pull request 834 github.com
- Vulnerable code in server/auth.go (1.0.0) github.com
- VulDB entry 425382 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:54.
Original description (NVD)
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.
NVD references (7)
- https://github.com/bytebase/bytebase
- https://github.com/bytebase/bytebase/blob/1.0.0/server/auth.go#L79-L93
- https://github.com/bytebase/bytebase/commit/d69e682243b25b51dd52912a26e2f259b5f3db2d
- https://github.com/bytebase/bytebase/pull/834
- https://github.com/bytebase/bytebase/releases/tag/1.0.1
- https://github.com/bytebase/bytebase/security/advisories/GHSA-5r3p-6rj5-7937
- https://www.vulncheck.com/advisories/bytebase-0.12.0-before-1.0.1-authentication-bypass-via-gitlab-self-hoste…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.