CVE-2025-7659 Web IDE Origin Validation Bypass

Deterministic high GitLab Added 6mo ago cve-verified-cve-2025-7659

Detects GitLab instances where the Web IDE iframe accepts arbitrary parentOrigin parameters, allowing cross-origin token theft. Versions 18.2.0–18.6.5, 18.7.0–18.7.3, and 18.8.0–18.8.3 are affected.

Related GitLab exploits

CVE-2026-3857 GraphQL CSRF — Arbitrary Mutation Execution
CVE-2026-1724 Unauthenticated AI Model Token Disclosure
CVE-2026-1868 AI Gateway Jinja2 Template Injection
CVE-2026-5173 WebSocket Authorization Bypass

Is your app exploitable through CVE-2025-7659?

Scan your domain free