CVE-2025-11984
Authentication Bypass Using an Alternate Path or Channel in GitLab
MEDIUM 6.8EPSS 0.4%
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to bypass WebAuthn two-factor authentication by manipulating the session state under certain conditions.
- Affected
- GitLab
- CVSS v3.1 GITLAB
- 6.8 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - EPSS
- 0.39% chance of exploitation in the next 30 days, 32nd percentile
- Published
- 2025-12-11
- Updated
- 2026-02-26