CVE-2026-2745
Medium · 6.8CVSS
6.8
EPSS
0.4%
Published
Mar 25, 2026
CISA due date
—
The record
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 7.11 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to bypass WebAuthn two-factor authentication and gain unauthorized access to user accounts due to inconsistent input validation in the authentication process.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-115829 In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step… CWE-288
- CVE-2026-119420 Lago through 1.55.0 contains an authentication bypass vulnerability that allows… CWE-288
- CVE-2026-118572 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth… CWE-288
- CVE-2026-118582 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA… CWE-288
- CVE-2026-118554 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID… CWE-288
- CVE-2026-114572 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain… CWE-288
- CVE-2026-114539 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck… CWE-288
- CVE-2026-107261 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal… CWE-288