CVE-2025-55750

Gitpod is a developer platform for cloud development environments. In versions before main-gha.33628 for both Gitpod Classic and Gitpod Classic Enterprise, OAuth integration with Bitbucket in certain conditions allowed a crafted link to expose a valid Bitbucket access token via the URL fragment when clicked by an authenticated user. This resulted from how Bitbucket returned tokens and how Gitpod handled the redirect flow. The issue was limited to Bitbucket (GitHub and GitLab integrations were not affected), required user interaction, and has been mitigated through redirect handling and OAuth logic hardening. The issue was resolved in main-gha.33628 and later. There are no workarounds.

• CWE-201

• https://github.com/gitpod-io/gitpod/commit/a736c1b83bd781786af0da705d0acebabfba7862
• https://github.com/gitpod-io/gitpod/pull/20983
• https://github.com/gitpod-io/gitpod/security/advisories/GHSA-63fw-3jgp-2p2g

Published

Aug 29, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55745UnoPim is an open-source Product Information Management (PIM…8.8
• CVE-2025-55746Directus is a real-time API and App dashboard for managing S…7.5
• CVE-2025-55747XWiki Platform is a generic wiki platform offering runtime s…9.1
• CVE-2025-55748XWiki Platform is a generic wiki platform offering runtime s…7.5
• CVE-2025-55749XWiki is an open-source wiki software platform. From 16.7.0 …7.5
• CVE-2025-5575A vulnerability classified as critical was found in PHPGuruk…9.8
• CVE-2025-55751OnboardLite is the result of the Influx Initiative, our visi…5.1
• CVE-2025-55752Relative Path Traversal vulnerability in Apache Tomcat. The…7.5
• CVE-2025-55753An integer overflow in the case of failed ACME certificate r…7.5
• CVE-2025-55754Improper Neutralization of Escape, Meta, or Control Sequence…9.6
• CVE-2025-55757A unauthenticated reflected XSS vulnerability in VirtueMart …6.1
• CVE-2025-55758Multiple CSRF attack vectors in JDownloads component 1.0.0-4…5.4