GitBook breach: SSO flaw led to production access; all API tokens revoked, rotate integration secrets
GitBook (hosted documentation platform)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
On Nov 2 2026 an attacker used a flaw in GitBook's SSO login flow to create sessions as GitBook staff, pulled credentials for a misconfigured internal GitHub App to reach GitBook's code repositories and a Cloudflare API key, and from there reached production secrets with full infrastructure access. GitBook took its app offline for about 16 hours (20:32 UTC Nov 2 to 11:56 UTC Nov 3), rotated every infrastructure and GitBook-managed customer secret, and invalidated all API tokens. It says the attack targeted one customer, but treats all customer data as exposed: API tokens, integration tokens and secrets, session signing secrets, authenticated-access docs, content, and the ability to act as the GitBook GitHub and GitLab apps in repositories customers had granted. GitBook says it can't tell whether the attacker acted in customer repositories. Billing data and passwords were not affected. Customers should create new API tokens, rotate third-party and integration secrets, regenerate authenticated-access signing keys, re-authenticate the GitBook MCP server, review connected repositories, and check logs for the published IPs.
Why this severity: Full production infrastructure access; all customer tokens and integration secrets treated as exposed; GitBook could act as its Git apps in customer repos
- Started
- Nov 2, 2026
Affected
- GitBook customers with API tokens, integrations, Git Sync (GitHub or GitLab), authenticated-access docs or the GitBook MCP server
Fixed in
- SSO flaw fixed Nov 2 2026 and all GitBook-side secrets rotated by Nov 3; customers must rotate their own tokens and secrets
Timeline3
GitBook publishes its post-mortem: all customer data treated as exposed, no evidence other customers' content was modified, and three attacker IP addresses published as indicators of compromise.
GitBook invalidates all existing API tokens, rotates GitHub app keys, and is fully back online at 11:56 UTC after about 16 hours of downtime; customers get rotation instructions.
Attacker hijacks an account at the targeted customer (12:27 UTC), gets staff sessions through an SSO flaw and source code access (16:32), and reaches production (17:48); GitBook fixes the SSO flaw (19:58) and takes the app offline (20:32).
Advisories1
News & write-ups1
Get an email when a new major security incident drops. No spam, unsubscribe any time.
