GitLab Alert: High-Severity 2FA Bypass & DoS Flaws Patched in Urgent Update

GitLab has issued an urgent security update for its Community and Enterprise editions to patch five high‑severity vulnerabilities that could allow Denial of Service attacks and authentication bypasses. The release covers versions 18.8.2, 18.7.2, and 18.6.4, and administrators are urged to upgrade immediately. Perhaps the most concerning flaw is CVE-2026-0723, an unchecked return value issue that could let someone bypass two‑factor authentication by submitting forged device responses, according to the advisory.

The update also fixes CVE-2025-13927 (Jira Connect), CVE-2025-13928 (Releases API), CVE-2025-13335 (Wiki loops), and CVE-2026-1102 (SSH requests), all of which could enable DoS or related impacts. For administrators, failing to patch leaves self‑managed installations open to a mix of disruptive attacks and potential account takeovers, with the guidance to upgrade to one of the listed target versions. According to GitLab, the issues range from API exploits to an authentication bypass and are being treated as high priority for remediation.