CVE-2024-4024: GitLab Auth Bypass Vulnerability

CVE-2024-4024 Overview

CVE-2024-4024 affects GitLab Community Edition (CE) and Enterprise Edition (EE) when Bitbucket is configured as an OAuth 2.0 provider. An attacker with valid Bitbucket account credentials can take over a GitLab account linked to another user's Bitbucket account under certain conditions. The flaw stems from improper authentication assumptions in the OAuth linking flow and is classified under [CWE-287] Improper Authentication and [CWE-302] Authentication Bypass by Assumed-Immutable Data.

The vulnerability affects all GitLab versions from 7.8 before 16.9.6, from 16.10 before 16.10.4, and from 16.11 before 16.11.1.

Critical Impact
Attackers can gain full access to victim GitLab accounts, exposing source code, CI/CD pipelines, secrets, and organizational repositories.

Affected Products

GitLab CE/EE versions 7.8 through 16.9.5
GitLab CE/EE versions 16.10 through 16.10.3
GitLab CE/EE versions 16.11.0

Discovery Timeline

2024-04-25 - CVE-2024-4024 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4024

Vulnerability Analysis

GitLab supports Bitbucket as an OAuth 2.0 identity provider, allowing users to authenticate to GitLab using their Bitbucket credentials. The vulnerability arises when GitLab links an authenticated Bitbucket identity to an existing GitLab account without sufficiently validating identity ownership. An attacker holding Bitbucket credentials tied to a specific identifier can trigger the account linking logic and gain access to a victim's GitLab account.

The issue falls under both improper authentication ([CWE-287]) and reliance on assumed-immutable OAuth data ([CWE-302]). GitLab treats data supplied by the Bitbucket provider as a stable, trusted identifier, but Bitbucket account attributes used in the linking process can align with those of an existing GitLab user. This mismatch between assumed and actual immutability allows account takeover.

The EPSS score of 14.9% places this CVE in the 96th percentile of exploit likelihood, indicating meaningful attacker interest.

Root Cause

The root cause is insufficient validation during the OAuth 2.0 account linking flow when Bitbucket is used as an external identity provider. GitLab links the Bitbucket-provided identity to a GitLab account based on attributes that are not guaranteed to be immutable or unique in the way GitLab assumed. This design flaw enables a linking condition that binds an attacker-controlled Bitbucket account to a victim's GitLab account.

Attack Vector

Exploitation requires the attacker to authenticate to Bitbucket with credentials they control and to trigger the OAuth 2.0 login flow against a GitLab instance that has Bitbucket configured as an OAuth provider. The attack is network-based and requires low privileges. On success, the attacker takes over the linked GitLab account and inherits all of the victim's repository, group, and pipeline permissions.

No public proof-of-concept has been released. Technical context is available in the GitLab Issue Report.

Detection Methods for CVE-2024-4024

Indicators of Compromise

Unexpected Bitbucket identity linking events in GitLab audit logs for existing accounts
OAuth 2.0 login events from unfamiliar IP addresses or geographies immediately followed by permission or SSH key changes
New personal access tokens, SSH keys, or CI/CD variables created shortly after a Bitbucket OAuth login
Repository clone or download spikes tied to accounts recently authenticated via Bitbucket

Detection Strategies

Review the GitLab audit_events table and admin audit logs for oauth provider entries referencing bitbucket and correlate with user sign-in history.
Alert on any change to a user's linked identities, particularly when a Bitbucket identity is added to a pre-existing account.
Correlate authentication events with subsequent privileged actions such as project transfer, protected branch modification, or runner registration.

Monitoring Recommendations

Ingest GitLab authentication and audit logs into a centralized SIEM for identity-linking anomaly detection.
Monitor for successful Bitbucket OAuth logins to accounts that historically authenticated only via password or SAML.
Track outbound Git operations per user to detect bulk repository exfiltration following suspicious logins.

How to Mitigate CVE-2024-4024

Immediate Actions Required

Upgrade GitLab CE/EE to version 16.9.6, 16.10.4, or 16.11.1 or later without delay.
If patching is not immediately possible, disable Bitbucket as an OAuth 2.0 provider in the GitLab configuration.
Audit all accounts with linked Bitbucket identities and require re-verification for any suspicious links.
Rotate personal access tokens, SSH keys, and CI/CD secrets for any account showing anomalous Bitbucket OAuth activity.

Patch Information

GitLab has released fixed versions 16.9.6, 16.10.4, and 16.11.1. Administrators should apply the patch corresponding to their deployment branch. Refer to the GitLab Issue Report for tracking details.

Workarounds

Remove Bitbucket from the list of enabled omniauth_providers in gitlab.rb until the instance is patched.
Enforce mandatory multi-factor authentication for all GitLab users to raise the cost of account takeover.
Restrict OAuth account linking to administrators only via GitLab's sign-in restrictions where feasible.

bash

# Configuration example: disable Bitbucket OAuth provider in /etc/gitlab/gitlab.rb
gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_providers'] = [
  # Remove or comment out the bitbucket entry below
  # {
  #   name: "bitbucket",
  #   app_id: "YOUR_APP_ID",
  #   app_secret: "YOUR_APP_SECRET"
  # }
]

# Apply the configuration change
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart