An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.3 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17.11.2. A security vulnerability allows attackers to bypass Device OAuth flow protections, enabling authorization form submission through minimal user interaction.
A product requires authentication, but the product has an alternate path or channel that does not require authentication.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 17.3.0 (including) | 17.9.8 (excluding) |
| Gitlab | Gitlab | 17.10.0 (including) | 17.10.6 (excluding) |
| Gitlab | Gitlab | 17.11.0 (including) | 17.11.2 (excluding) |
| Gitlab | Ubuntu | esm-apps/xenial | * |