GitLab contains a flaw where an unauthenticated attacker can modify a shared cache holding OAuth/OIDC discovery documents. By injecting user‐supplied values into cached responses, the system may create endpoint URLs that redirect authentication flows to an attacker‑controlled server. This could lead to credential leakage or session hijacking, as tokens or login data may be forwarded to an attacker’s domain. The weakness is identified as HTTP request smuggling (CWE‑444).

All GitLab Community Edition and Enterprise Edition releases from version 18.3 up to but excluding 19.3.6, every 19.4 release prior to 19.4.3, and every 19.5 release prior to 19.5.1 are impacted. Upgrading to 19.3.6, 19.4.3, 19.5.1 or later removes the vulnerability.

The CVSS base score of 7.5 classifies the issue as high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated remote user sending crafted HTTP requests to the GitLab instance. Exploitation requires the attacker to poison a shared cache; the exact conditions are not fully detailed, so the precise exploitability is uncertain, but the potential impact on authentication flows is significant.