Bytebase: Authentication bypass via GitLab provider configuration (CVE-2022-51026)

Bytebase versions prior to 1.0.1 contain an authentication bypass vulnerability (CVE-2022-51026) in the /api/auth/login/GITLAB_SELF_HOST endpoint. The vulnerability exists because the application improperly trusts client-supplied GitLab provider configuration. An attacker can supply a malicious instanceUrl pointing to a server they control, which returns a fabricated active user response. Bytebase uses this response to generate session tokens, enabling the attacker to impersonate arbitrary users or create new accounts with elevated privileges.

Impact

Successful exploitation allows unauthenticated attackers to gain unauthorized access to the Bytebase instance by impersonating existing users, including the Owner role, or by creating new members.

Recommendation

• Upgrade Bytebase to version 1.0.1 or later immediately.
• Review access logs and audit trails for unexpected authentication events or suspicious user creations within Bytebase if the instance was exposed during the vulnerable period.
• Disable GitLab self-hosted authentication providers if they are not actively required for environment workflows.