PT-2025-35245 · Gitpod+1 · Gitpod+1

Mirc · Published 2025-08-29 · Updated 2025-08-29 · CVE-2025-55750

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gitpod versions prior to main-gha.33628

Description Gitpod, a developer platform for cloud development environments, experienced an issue where OAuth integration with Bitbucket, under specific conditions, could expose a valid Bitbucket access token via the URL fragment when a crafted link was clicked by an authenticated user. This occurred due to the way Bitbucket returned tokens and how Gitpod handled the redirect flow. The issue was limited to Bitbucket integrations and required user interaction.

Recommendations Update to version main-gha.33628 or later.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2025-55750

GHSA-63FW-3JGP-2P2G

Affected Products

Bitbucket

Gitpod

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55750.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-55750 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55750 · Vendor Advisory
• https://github.com/gitpod-io/gitpod/commit/a736c1b83bd781786af0da705d0acebabfba7862 · Note
• https://github.com/gitpod-io/gitpod/pull/20983 · Note
• https://github.com/gitpod-io/gitpod/security/advisories/GHSA-63fw-3jgp-2p2g · Note
• https://twitter.com/VulmonFeeds/status/1961487401190039640 · Twitter Post
• https://twitter.com/CVEnew/status/1961463469502521755 · Twitter Post