The vulnerability arises from an unchecked return value that permits an attacker who knows a victim’s credential ID to forge device responses. This flaw undermines GitLab’s two‑factor authentication, allowing unauthorized authentication to the victim's account. The failure is identified as CWE‑252, exposing confidential account access and jeopardizing data integrity on all impacted installations.

GitLab Community Edition and Enterprise Edition are affected. All releases from 18.6 prior to 18.6.4, 18.7 prior to 18.7.2, and 18.8 prior to 18.8.2 are vulnerable, regardless of the distribution (community or enterprise).

The CVSS score of 7.4 signals a high severity level, while an EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not cataloged in the CISA Known Exploited Vulnerabilities list. The attack vector is remote, requiring an attacker with knowledge of a credential ID to submit forged device responses, which can then bypass two‑factor verification and grant the attacker access to the target account.