Unrated

Authentication bypass in Gitblit SSH service

IdentifiersCVE-2024-28080CWE-287

CVE-2024-28080 is an authentication bypass vulnerability in Gitblit’s SSH service. The flaw is in Gitblit’s integration with Apache MINA SSHD, specifically its handling of multi-stage public-key authentication. During the initial public-key authentication stage, Gitblit’s SshKeyAuthenticator.authenticate method stores authenticated user state in the ServerSession-backed SshDaemonClient by calling client.setUser(user) and client.setKey(key) as soon as the supplied public key matches a configured key for the requested username, before proof-of-possession of the corresponding private key has been verified. If signature generation or verification does not complete successfully, the session can still retain that user state. Gitblit’s UsernamePasswordAuthenticator.authenticate method then returns success early when client.getUser() is not null, causing subsequent password authentication to succeed even with an arbitrary or empty password. As a result, an attacker can impersonate a user on the SSH transport without the victim’s private key or password, provided the attacker knows a valid username and one of that user’s configured public keys. The issue reportedly affects Gitblit versions prior to 1.10.0 with public-key SSH authentication enabled.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows unauthorized authentication to Gitblit over SSH as another user. An attacker can impersonate any target account that has at least one public key associated with it, bypassing both private-key proof-of-possession and password verification. The practical impact is unauthorized access to Git repositories and any SSH-mediated actions permitted to the impersonated account, including reading or modifying repository contents depending on that user’s privileges.

Mitigation

If you can’t patch tonight, do this now.

As an interim mitigation, disable Gitblit’s SSH service or restrict SSH access to trusted networks and users only. Because exploitation requires a target account with at least one configured public key, reducing or removing SSH public-key authentication exposure for Gitblit accounts may reduce risk, but the available information does not provide a vendor-supported configuration workaround short of applying the fixed version or disabling the affected service.

Remediation

Patch, then assume compromise.

Upgrade Gitblit to version 1.10.0 or later, which fixes CVE-2024-28080. The fix was confirmed in Gitblit 1.10.0, released on 14 June 2025. If upgrading is not immediately possible, remove or disable the vulnerable SSH service until a fixed release can be deployed.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

silentsignal blogNews

Aug 29, 2025

Rage Against the Authentication State Machine - Silent Signal Techblog

An authentication bypass vulnerability in Gitblit's SSH service that allows impersonation of users who have at least one public key assigned, due to flawed state handling between public-key and password authentication.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity7