CVE-2026-12910

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing authentication enforcement checks.

• CWE-306

• https://gitlab.com/gitlab-org/gitlab/-/work_items/603742Broken Link
• https://hackerone.com/reports/3745561Permissions Required

Published

Sep 15, 2026

Last Modified

Sep 28, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12904The Kadence Blocks – Gutenberg Blocks for Page Builder Featu…4.3
• CVE-2026-12905The Bookly plugin for WordPress is vulnerable to Insecure Di…4.3
• CVE-2026-12906The RTMKit WordPress plugin before 2.0.9 does not perform a …2.7
• CVE-2026-12907The RTMKit WordPress plugin before 2.0.9 does not perform a …2.7
• CVE-2026-12908Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-1291The Meow Gallery plugin for WordPress is vulnerable to unaut…4.3
• CVE-2026-12912A flaw was found in libtiff. A remote attacker could exploit…7.3
• CVE-2026-12918The Mail Mint – Email Marketing, Newsletter, Email Automatio…4.9
• CVE-2026-1292Tanium addressed an insertion of sensitive information into …6.5
• CVE-2026-12920The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plug…4.9
• CVE-2026-12921In AzeoTech DAQFactory versions 21.1 and prior, a Use After …7.8
• CVE-2026-12923The Youtube Showcase plugin for WordPress is vulnerable to A…7.5