CVE-2025-55750: Gitpod Information Disclosure Vulnerability

CVE-2025-55750 Overview

CVE-2025-55750 is an information disclosure vulnerability in Gitpod, a developer platform for cloud development environments. The flaw affects both Gitpod Classic and Gitpod Classic Enterprise in versions before main-gha.33628. In specific conditions, the OAuth integration with Bitbucket allowed a crafted link to expose a valid Bitbucket access token through the URL fragment when clicked by an authenticated user. The issue resulted from how Bitbucket returned tokens and how Gitpod handled the redirect flow. GitHub and GitLab integrations were not affected. The weakness is classified under CWE-201: Insertion of Sensitive Information Into Sent Data.

Critical Impact
A crafted link clicked by an authenticated Gitpod user could leak a valid Bitbucket OAuth access token to an attacker-controlled destination via URL fragment inheritance.

Affected Products

Gitpod Classic versions before main-gha.33628
Gitpod Classic Enterprise versions before main-gha.33628
Deployments using Bitbucket OAuth integration (GitHub and GitLab integrations are not affected)

Discovery Timeline

2025-08-29 - CVE-2025-55750 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55750

Vulnerability Analysis

The vulnerability stems from the interaction between Bitbucket's OAuth implicit flow and Gitpod's redirect handling. Bitbucket returns access tokens using response_type=token, which places the token in the URL fragment (#access_token=...) rather than the query string. When a browser follows a redirect to a URL that lacks its own fragment, it inherits the fragment from the previous URL. If Gitpod redirected a user to an attacker-controlled returnTo URL that did not contain a fragment, the browser propagated the access token to that destination.

Exploitation required user interaction, specifically an authenticated Gitpod user clicking a crafted OAuth authorization link. An attacker who received the leaked token could then act on behalf of the victim against Bitbucket APIs within the scope granted to Gitpod.

Root Cause

Two conditions combined to create the disclosure. First, Bitbucket's OAuth response placed the access token in the fragment component of the redirect URL. Second, Gitpod's returnTo handling did not enforce a fragment on outbound redirects, allowing browsers to inherit the token-bearing fragment from the OAuth callback and forward it to the final destination. The patch also introduced nonce-based CSRF protection for OAuth flows as defense in depth.

Attack Vector

An attacker crafts a Gitpod OAuth authorization link with a returnTo parameter pointing to a controlled URL without a fragment. The victim, already authenticated to Gitpod and having authorized Bitbucket, clicks the link. The browser follows the OAuth dance, receives the token in the fragment, and then follows Gitpod's subsequent redirect to the attacker-controlled URL, carrying the fragment (and token) along.

typescript

// Patch: components/server/src/auth/fragment-utils.ts
// Ensures a returnTo URL has a fragment to prevent OAuth token inheritance attacks.
//
// When OAuth providers use response_type=token, they redirect with access tokens
// in URL fragments. If the returnTo URL doesn't have a fragment, browsers inherit
// the current page's fragment, potentially exposing tokens to malicious sites.
export function ensureUrlHasFragment(url: string): string {
    try {
        const parsedUrl = new URL(url);
        // If URL already has a fragment, return as-is
        if (parsedUrl.hash) {
            return url;
        }
        // Add empty fragment to prevent inheritance
        return url + "#";
    } catch (error) {
        // If URL is invalid, add fragment anyway
        return url + "#";
    }
}

Source: Gitpod commit a736c1b

Detection Methods for CVE-2025-55750

Indicators of Compromise

Bitbucket OAuth authorization requests originating from Gitpod followed by redirects to external, non-Gitpod domains.
Access log entries showing returnTo parameters pointing to domains outside the organization's trusted list.
Unexpected Bitbucket API calls from IP addresses that do not correspond to Gitpod workspace infrastructure.

Detection Strategies

Review Gitpod server logs for OAuth callback handling that redirects to arbitrary external URLs without a fragment component.
Audit Bitbucket account activity for API usage that does not correspond to legitimate Gitpod workspace sessions.
Correlate authentication events in Bitbucket audit logs against known Gitpod workspace start times for the same user.

Monitoring Recommendations

Enable detailed logging of OAuth flows in both Gitpod and Bitbucket, capturing full redirect chains.
Monitor for anomalous token usage patterns such as access from unexpected geolocations or user agents.
Alert on Bitbucket personal access token or OAuth token activity outside business hours or without a corresponding Gitpod session.

How to Mitigate CVE-2025-55750

Immediate Actions Required

Upgrade Gitpod Classic and Gitpod Classic Enterprise to version main-gha.33628 or later.
Rotate any Bitbucket OAuth tokens issued to Gitpod prior to the upgrade, and review Bitbucket authorized applications.
Audit Bitbucket account activity for unauthorized access that may correlate with clicks on suspicious Gitpod links.

Patch Information

The issue was resolved in Gitpod main-gha.33628 and later releases. The fix hardens redirect handling and OAuth logic, introducing the ensureUrlHasFragment utility to prevent fragment inheritance and adding nonce-based CSRF protection to OAuth flows. See the Gitpod security advisory GHSA-63fw-3jgp-2p2g and pull request #20983 for full technical details.

Workarounds

No workarounds are available per the vendor advisory; upgrading to main-gha.33628 or later is required.
As an interim risk reduction measure, users may revoke Gitpod's Bitbucket authorization until the upgrade is completed.

bash

# Verify Gitpod version after upgrade
kubectl -n gitpod get deployment server -o jsonpath='{.spec.template.spec.containers[0].image}'

# Expected: image tag at main-gha.33628 or later