Critical severity9.8OSV Advisory· Published Mar 24, 2018· Updated Jun 17, 2026
CVE-2018-8971
CVE-2018-8971
Description
The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users.
Affected products
4v1.2.0, v1.2.0pre, v1.2.1, …+ 2 more
- (no CPE)range: v1.2.0, v1.2.0pre, v1.2.1, …
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: <=10.3.8
- (no CPE)range: before 10.3.9, 10.4.x before 10.4.6, 10.5.x before 10.5.6
Patches
Vulnerability mechanics
References
2- about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/nvdVendor Advisory
- www.debian.org/security/2018/dsa-4206nvdThird Party Advisory
News mentions
0No linked articles in our index yet.