Skip to main content

Insertion of Sensitive Information Into Sent Data

CVE-2025-55750

Medium
6.5/10

Summary

Gitpod is a developer platform for cloud development environments. In versions prior to main-gha.33628 both Gitpod Classic and Gitpod Classic Enterprise, OAuth integration with Bitbucket in certain conditions, allowed a crafted link to expose a valid Bitbucket access token via the URL fragment when clicked by an authenticated user. This resulted from how Bitbucket returned tokens and how Gitpod handled the redirect flow. The issue was limited to Bitbucket (GitHub and GitLab integrations were not affected), required user interaction, and has been mitigated through redirect handling and OAuth logic hardening.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • NONE
  • HIGH
  • NONE

CWE-201 - Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

References

Advisory Timeline

  • Published