GitBook breach: SSO flaw led to production access; all API tokens revoked, rotate integration secrets ยท updates https://pwn.watch/i/gitbook-sso-flaw-infrastructure-breach-nov-2026 On Nov 2 2026 an attacker used a flaw in GitBook's SSO login flow to create sessions as GitBook staff, pulled credentials for a misconfigured internal GitHub App to reach GitBook's code repositories and a Cloudflare API key, and from there reached production secrets with full infrastructure access. GitBook took its app offline for about 16 hours (20:32 UTC Nov 2 to 11:56 UTC Nov 3), rotated every infrastructure and GitBook-managed customer secret, and invalidated all API tokens. It says the attack targeted one customer, but treats all customer data as exposed: API tokens, integration tokens and secrets, session signing secrets, authenticated-access docs, content, and the ability to act as the GitBook GitHub and GitLab apps in repositories customers had granted. GitBook says it can't tell whether the attacker acted in customer repositories. Billing data and passwords were not affected. Customers should create new API tokens, rotate third-party and integration secrets, regenerate authenticated-access signing keys, re-authenticate the GitBook MCP server, review connected repositories, and check logs for the published IPs. en Wed, 04 Nov 2026 00:00:00 GMT GitBook breach: SSO flaw led to production access; all API tokens revoked, rotate integration secrets: GitBook publishes its post-mortem: all customer data treated as exposed, no evidence other customers' content was modified, and three attacker IP addresses published as indicators of compromise. https://pwn.watch/i/gitbook-sso-flaw-infrastructure-breach-nov-2026 https://pwn.watch/i/gitbook-sso-flaw-infrastructure-breach-nov-2026#2026-11-04-8e2f54a1 Wed, 04 Nov 2026 00:00:00 GMT high <p><a href="https://www.gitbook.com/status/security-incident-2026-11-03">Source</a></p> GitBook breach: SSO flaw led to production access; all API tokens revoked, rotate integration secrets: GitBook invalidates all existing API tokens, rotates GitHub app keys, and is fully back online at 11:56 UTC after about 16 hours of downtime; customers get rotation instructions. https://pwn.watch/i/gitbook-sso-flaw-infrastructure-breach-nov-2026 https://pwn.watch/i/gitbook-sso-flaw-infrastructure-breach-nov-2026#2026-11-03-99bb0f2a Tue, 03 Nov 2026 00:00:00 GMT high <p><a href="https://www.gitbook.com/status/security-incident-2026-11-03">Source</a></p> GitBook breach: SSO flaw led to production access; all API tokens revoked, rotate integration secrets: Attacker hijacks an account at the targeted customer (12:27 UTC), gets staff sessions through an SSO flaw and source code access (16:32), and reaches production (17:48); GitBook fixes the SSO flaw (19:58) and takes the app offline (20:32). https://pwn.watch/i/gitbook-sso-flaw-infrastructure-breach-nov-2026 https://pwn.watch/i/gitbook-sso-flaw-infrastructure-breach-nov-2026#2026-11-02-41fccb38 Mon, 02 Nov 2026 00:00:00 GMT high <p><a href="https://www.gitbook.com/status/security-incident-2026-11-03">Source</a></p>