GitLab WebAuthn Two-Factor Authentication Bypass Vulnerability

A vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 13.1 prior to 18.4.6, 18.5 prior to 18.5.4, and 18.6 prior to 18.6.2. This vulnerability could have allowed an authenticated user to bypass WebAuthn two-factor authentication by manipulating the session state under certain conditions.

Impact

Exploitation of this vulnerability could have led to unauthorized bypassing of WebAuthn two-factor authentication, allowing users to authenticate without the required second factor.

Remediation

Users are advised to upgrade to GitLab versions 18.6.2, 18.5.4, or 18.4.6. Instructions for updating GitLab can be found on the GitLab Update page. This patch includes database migrations that may impact the upgrade process, causing downtime for single-node instances.