{"uuid": "be485102-fc4a-4090-bcb3-45e8b2a4e24c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1162", "type": "seen", "source": "https://t.me/hacking_Attack/51273", "content": "Exploit Collector\nGitlab 14.9 Authentication Bypass\n\nhttps://3.bp.blogspot.com/-p2bRUn4ag8U/WWlvPJDaCwI/AAAAAAAAIMw/gkQGiTtaXucRRVbpvBkwiWIbJMO4BFlLwCLcBGAs/s1600/h28.png \nGitlab versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.7 prior to 14.7.7 suffer from a bypass vulnerability due to having set a hardcoded password for accounts registered using an OmniAuth provider.\n\nSHA-256 | b9871a137c86a7af7a3f259af24481816299cde62d5eef695abcb78150bb320f\n\nDownload\n# Exploit Title: Gitlab 14.9 - Authentication Bypass\n# Date: 12/04/2022\n# Exploit Authors: Greenwolf & stacksmashing\n# Vendor Homepage: https://about.gitlab.com/\n# Software Link: https://about.gitlab.com/install\n# Version: GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2\n# Tested on: Linux\n# CVE : CVE-2022-1162\n# References: https://github.com/Greenwolf/CVE-2022-1162\n\nA hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts.\n\nExploit:\n\nNew Gitlab Accounts (created since the first affect version and if Gitlab is before the patched version) can be logged into with the following password:\n\n123qweQWE!@#000000000\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:42.992238Z"}