Bleepingcomputer – Over 5,300 GitLab servers exposed to zero-click account takeover attacks

“Although the flaw does not bypass two-factor authentication (2FA), it is a significant risk for any accounts not protected by this extra security mechanism.”