CVE-2025-11984: 
GitLab vulnerability analysis and mitigation

CVE-2025-11984 is an authentication bypass vulnerability in GitLab CE/EE that allows an authenticated user to circumvent WebAuthn two-factor authentication by manipulating the session state under certain conditions. It affects all GitLab CE/EE versions from 13.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2. The vulnerability was disclosed on December 10–11, 2025, as part of GitLab's scheduled patch release. It carries a CVSS v3.1 base score of 6.8 (Medium) (GitLab Advisory, Red Hat CVE).

The root cause is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). An authenticated attacker can manipulate the WebAuthn session state during the two-factor authentication flow to bypass the second factor entirely, gaining access without completing the hardware key challenge. The attack requires network access, low-level privileges (a valid account), and high complexity to execute, but no user interaction. The vulnerability was reported by researcher "jcarre" through GitLab's HackerOne bug bounty program, and the GitLab issue tracker entry (gitlab-org/gitlab#577847) and HackerOne report #3322714 are referenced as primary sources (GitLab Advisory).

Successful exploitation allows an attacker with valid credentials to bypass WebAuthn 2FA and gain full authenticated access to a GitLab account, including any repositories, CI/CD pipelines, secrets, and sensitive project data associated with that account. The confidentiality and integrity impacts are both rated High, as an attacker could read or modify source code, inject malicious pipeline configurations, or exfiltrate secrets stored in GitLab. Availability is not impacted. The scope is limited to the compromised account, but lateral movement within a GitLab instance (e.g., accessing shared projects or group resources) is possible depending on the victim account's permissions (GitLab Advisory, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.023% (0.000230), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity requirement (session state manipulation under specific conditions) limits opportunistic exploitation (Red Hat CVE).

GitLab has released patched versions 18.4.6, 18.5.4, and 18.6.2 on December 10, 2025, which remediate this vulnerability. All self-managed GitLab installations running affected versions (13.1 through 18.6.1) should upgrade to one of these versions immediately. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action. No configuration-based workaround has been published; upgrading is the only recommended remediation (GitLab Advisory).

The vulnerability was covered by cybersecurity news outlets including Cybersecurity News and eSecurity Planet as part of broader coverage of the December 2025 GitLab patch release, which addressed multiple high-severity issues including XSS and DoS vulnerabilities. The Belgian Centre for Cybersecurity (CCB) issued an advisory warning about the high-severity vulnerabilities in this GitLab release. Community reaction has been moderate, with the 2FA bypass drawing attention given the wide version range affected (since GitLab 13.1) (Cybersecurity News, eSecurity Planet).