CVE-2019-12300: Buildbot OAuth Token Authentication Bypass
Summary
CVE-2019-12300: Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. Affects buildbot across 2 version ranges.
< 1.8.2
>= 2.0.1, < 2.3.1
Fixed in 1.8.2 or 2.3.1, depending on the release line you run. How to fix ↓
Also tracked for
- buildbot · Debian:11
The same CVE-2019-12300 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildbot is an open-source continuous integration framework written in Python. It allows developers to automate the build, test, and release processes of their software projects. Buildbot supports various authentication methods, including OAuth. However, prior to version 1.8.2 and 2.x before 2.3.1, it had a vulnerability that allowed an attacker to bypass authentication using a user-submitted authorization token obtained through OAuth. This token could be used to impersonate another user and gain unauthorized access to their account.
Vulnerability Detail
The vulnerability (CVE-2019-12300) in Buildbot arises from the improper handling of user-submitted authorization tokens obtained through OAuth. An attacker who possesses a token allowing them to read the user details of a victim can exploit this vulnerability to log in as the victim. This could lead to unauthorized access to sensitive information, manipulation of build processes, or other malicious activities.
How To Fix
Latest published version: 4.3.0 as of 22 Oct 2026
pip install --upgrade "buildbot==4.3.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.8.21.8.2pip install --upgrade "buildbot==1.8.2" -
>= 2.0.1, < 2.3.12.3.1pip install --upgrade "buildbot==2.3.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
Buildbot versions prior to 1.8.2 and 2.x before 2.3.1 are vulnerable to an authentication bypass vulnerability when using OAuth. This could allow an attacker to impersonate other users and gain unauthorized access. It is recommended to upgrade to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for buildbot →
FAQ
Buildbot is an open-source continuous integration framework written in Python. It helps automate the build, test, and release processes of software projects.
OAuth is an open standard for authorization that allows users to grant access to their resources on one website to another website without sharing their credentials.
The vulnerability in Buildbot occurs due to the improper handling of user-submitted authorization tokens obtained through OAuth, allowing an attacker to bypass authentication and impersonate another user.
This vulnerability could lead to unauthorized access to sensitive information, manipulation of build processes, or other malicious activities by an attacker who can impersonate another user.
To fix this vulnerability, users of Buildbot should upgrade to version 1.8.2 or later (for the 1.x branch) or version 2.3.1 or later (for the 2.x branch). These versions include the necessary fixes to prevent token-based authentication bypass.
Related vulnerabilities
Recent vulnerabilities recorded for buildbot.
