CVE-2025-55750

MEDIUM EPSS 22.3%
Published Aug 29, 202510mo ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Aug 29, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago

Description

Gitpod is a developer platform for cloud development environments. In versions before main-gha.33628 for both Gitpod Classic and Gitpod Classic Enterprise, OAuth integration with Bitbucket in certain conditions allowed a crafted link to expose a valid Bitbucket access token via the URL fragment when clicked by an authenticated user. This resulted from how Bitbucket returned tokens and how Gitpod handled the redirect flow. The issue was limited to Bitbucket (GitHub and GitLab integrations were not affected), required user interaction, and has been mitigated through redirect handling and OAuth logic hardening. The issue was resolved in main-gha.33628 and later. There are no workarounds.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
22.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-201

References 3

  • github.com https://github.com/gitpod-io/gitpod/commit/a736c1b83bd781786af0da705d0acebabfba7862
  • github.com https://github.com/gitpod-io/gitpod/pull/20983
  • github.com https://github.com/gitpod-io/gitpod/security/advisories/GHSA-63fw-3jgp-2p2g

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.