CVE-2022-51026Critical· 9.8▾ MidnightBytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/lo…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
critical → medium
0.6%
Last analysed / modified upstream
medium → critical
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.
bytebase >= 0.12.0 < 1.0.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/bytebase/bytebase < 1.0.1Patched in:
github.com/bytebase/bytebase 1.0.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115321Medium· 4.3Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment
CVE-2026-115322Medium· 4.3Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers
CVE-2026-62367High· 7.5Vikunja is an open-source self-hosted task management platform
CVE-2026-62987Medium· 5.8Fabio is an HTTP(S) and TCP router for deploying applications managed by consul
CVE-2026-61682Critical· 9.9kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads
CVE-2026-59157Medium· 6.5webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests