GitLab has rolled out urgent patches across Community and Enterprise editions to address a critical authentication bypass vulnerability scored at CVSS 9.9 (CVE-2024-45409). If exploited, unauthenticated adversaries can forge SAML authentication claims to hijack any account, including root administrators.
Cryptographic Signature Verification Flaws in Ruby-SAML
The root issue stems from improper validation of XML digital signatures inside underlying OmniAuth-SAML and ruby-saml authentication gems. An attacker capable of intercepting or crafting a SAML assertion can bypass cryptographic signature verification entirely, achieving full authentication without valid single sign-on credentials or MFA verification.
Affected Versions and Remediation Strategy
Self-hosted deployments utilizing SAML authentication must upgrade immediately to patched releases 17.3.3, 17.2.7, 17.1.8, 17.0.8, or 16.11.10. Administrators should also inspect audit logs for anomalous logins preceding patch deployment.