Executive brief
GitLab Community and Enterprise editions contain a flaw that allows authenticated users to bypass SAML single sign-on (SSO) restrictions and log in without using the required SSO authentication method. An attacker with valid credentials could circumvent corporate identity controls and access GitLab without going through the organization's centralized authentication system, potentially compromising account security and compliance controls.
Technical details
This vulnerability is an authentication bypass in GitLab's SAML SSO enforcement logic, caused by missing authentication checks that should prevent non-SSO sign-in when SSO is mandated. An authenticated user can craft a request to bypass the SSO sign-in requirement and authenticate directly. The vulnerability requires valid user credentials and network access to a GitLab instance with SAML SSO enabled. Successful exploitation allows an attacker to authenticate without SSO, bypassing organizational identity and access controls. Patches are available in versions 19.1.8, 19.2.6, and 19.3.2 or later.
Affected products
- GitLab GitLab Community Edition 18.6 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
- GitLab GitLab Enterprise Edition 18.6 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
Timeline
- 2026-09-15: disclosed