Bytebase 0.12.0 before 1.0.1 includes an authentication bypass that permits attackers to obtain session tokens for any user. The flaw arises from trusting client‑supplied GitLab provider data at the GITLAB_SELF_HOST login endpoint. By sending a crafted POST request with an instanceUrl pointing to an attacker‑controlled GitLab server that authenticates a chosen email, the server issues tokens for that principal. The attacker can then impersonate owners or create new members, compromising the entire deployment.

The vulnerability impacts the Bytebase database versioning platform in all releases prior to 1.0.1, including 0.12.0 and 1.0.0. Any deployment using those versions is affected; upgrading to 1.0.1 or later resolves the issue.

The CVSS score is 9.3, indicating a high severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The attack can be performed by any unauthenticated actor capable of sending a POST request to /api/auth/login/GITLAB_SELF_HOST and supplying a fabricated instanceUrl. The attacker only needs control of a GitLab server that returns a valid email address; the attack path is straightforward over the network.