CVE-2026-0723: Unchecked Return Value in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an individual with existing knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses.
Other sources
GitLab has remediated an issue that could have allowed an individual with existing knowledge of a victim’s credential ID to bypass two-factor authentication by submitting forged device responses.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-0723?
CVE-2026-0723 is considered a high severity vulnerability due to its potential to allow unauthorized access to sensitive information.
How do I fix CVE-2026-0723?
To fix CVE-2026-0723, update GitLab to version 18.6.4, 18.7.2, or 18.8.2 or later.
What versions of GitLab are affected by CVE-2026-0723?
CVE-2026-0723 affects GitLab versions prior to 18.6.4, 18.7.2, and 18.8.2.
What type of vulnerability is CVE-2026-0723?
CVE-2026-0723 is categorized as an unchecked return value vulnerability in GitLab's authentication services.
Can CVE-2026-0723 lead to data breaches?
Yes, CVE-2026-0723 can potentially lead to data breaches by allowing attackers with knowledge of victim credentials to bypass authentication.