CVE-2026-0723

CVSS 3.1: 7.4 high
EPSS: <1%p56
Published: Jan 22, 2026 · Jan 22, 2026
Modified: Jun 17, 2026

Analyze CVE-2026-0723 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an individual with existing knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses.

Vendors: gitlab

Products: gitlab

Weakness: CWE-252

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news

2 stories

GitLab warns of max severity code execution vulnerability

GitLab patched maximum-severity unauthenticated RCE CVE-2026-97229 in its CI/CD regex compiler.

BleepingComputerOct 12, 13:09 UTC · 18d agoVulnerabilityCVE-2026-97229 CVE-2026-0723 CVE-2026-857064 · 2 reads

Zoom and GitLab Release Security Updates Fixing RCE, DoS, and 2FA Bypass Flaws

The Hacker NewsJan 21, 15:42 UTC · Jan 21, 2026VulnerabilityExploitedCVE-2026-22844 CVE-2025-13927 CVE-2025-13928+33 · 1 read