CVE-2025-0549: GitLab Auth Bypass Vulnerability

CVE-2025-0549 Overview

CVE-2025-0549 is an authentication bypass vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects the Device OAuth flow, allowing attackers to bypass authorization form protections through minimal user interaction. The issue is classified under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel).

Affected versions span GitLab 17.3 through 17.9.8, 17.10 prior to 17.10.6, and 17.11 prior to 17.11.2. GitLab addressed the vulnerability across all three release branches. An attacker exploiting this flaw can trigger authorization form submission with limited victim interaction, potentially gaining unauthorized OAuth token access to protected resources.

Critical Impact
Attackers can bypass GitLab Device OAuth flow protections to submit authorization forms with minimal user interaction, leading to unauthorized access to user accounts and repository data.

Affected Products

GitLab CE/EE versions 17.3 through 17.9.7
GitLab CE/EE versions 17.10 through 17.10.5
GitLab CE/EE versions 17.11 through 17.11.1

Discovery Timeline

2025-05-09 - CVE-2025-0549 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0549

Vulnerability Analysis

The vulnerability resides in the GitLab Device Authorization Grant flow, an OAuth 2.0 extension defined by RFC 8628. This flow is designed for devices with limited input capabilities, requiring users to visit a verification URL and approve a device code. The protection layer intended to prevent automated or coerced approvals fails to enforce sufficient user interaction requirements.

An attacker can craft a request that submits the authorization confirmation form without the user performing an explicit, informed approval action. Because the Device OAuth flow issues access tokens tied to the victim's identity, a successful bypass grants the attacker OAuth credentials scoped to that user. The exploit requires user interaction, but the interaction threshold has been reduced to a level insufficient to constitute meaningful consent.

Root Cause

The root cause is an alternate path in the authorization endpoint that permits form submission without validating the full sequence of user consent controls. Authorization confirmation logic accepts submissions that bypass anti-clickjacking or confirmation protections normally required to authorize a device.

Attack Vector

The attack vector is network-based and requires the attacker to lure a target user to a malicious page while an active GitLab session exists. The attacker initiates a device authorization request, then uses a crafted page to trigger form submission on the victim's behalf. High attack complexity reflects the need for precise timing and social engineering. Successful exploitation yields OAuth tokens with the victim's privileges, impacting confidentiality and integrity of GitLab-hosted resources.

No verified public proof-of-concept code is available. Technical details are documented in the GitLab Issue #513996 and the HackerOne Report #2927555.

Detection Methods for CVE-2025-0549

Indicators of Compromise

Unexpected OAuth access token issuance events tied to the /oauth/device endpoint in GitLab audit logs.
Device authorization approvals originating from user sessions with short dwell times on the verification page.
OAuth token usage from IP addresses or user agents that differ from the user's normal access patterns.

Detection Strategies

Review GitLab application and audit logs for oauth_access_token creation events correlated with device grant flows.
Correlate device authorization confirmations with HTTP referrers from untrusted external origins.
Alert on repeated device authorization requests targeting the same user within short intervals.

Monitoring Recommendations

Ingest GitLab audit events and OAuth token issuance logs into a centralized SIEM for retention and correlation.
Monitor API activity performed by newly issued OAuth tokens for anomalous repository clones, secret access, or CI/CD job triggers.
Track user-agent and geolocation anomalies on OAuth-authenticated API calls following device grant approvals.

How to Mitigate CVE-2025-0549

Immediate Actions Required

Upgrade GitLab CE/EE to version 17.9.8, 17.10.6, or 17.11.2 or later depending on the deployed branch.
Revoke existing device OAuth tokens issued during the vulnerable window and require re-authorization.
Audit OAuth applications configured with the device authorization grant type and disable those not in active use.

Patch Information

GitLab released fixes in versions 17.9.8, 17.10.6, and 17.11.2. Self-managed GitLab administrators should apply the appropriate patched release for their upgrade path. GitLab.com SaaS tenants are patched by GitLab. Refer to the GitLab Issue #513996 for release notes and remediation guidance.

Workarounds

Disable the Device Authorization Grant flow for OAuth applications that do not require it until patching is complete.
Enforce shorter OAuth token lifetimes and mandatory re-authentication for sensitive scopes.
Restrict administrative and CI/CD scopes on OAuth applications to limit the blast radius of a compromised token.

bash

# Verify GitLab version after upgrade
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Revoke active OAuth access tokens via Rails console
sudo gitlab-rails runner "Doorkeeper::AccessToken.where(revoked_at: nil).update_all(revoked_at: Time.current)"