GitBook breach began with an SSO flaw; customers told to rotate tokens
Sorted AI18h agoGitBook's post-mortem says an attacker used a flaw in its SSO login flow on 2 November to create sessions as GitBook staff, then pulled credentials from a misconfigured GitHub App and eventually a Cloudflare API key that exposed production secrets. GitBook took the app offline for about 16 hours, rotated every infrastructure secret and GitBook-managed customer secret, and invalidated existing API tokens. It says the attack appears aimed at one customer but treats all customer data as exposed, including API and integration tokens and questions site visitors asked GitBook Assistant. GitBook says the speed and precision pointed to an attack driven largely by automation and AI; that is its own reading, not a confirmed finding.
Why it matters: If your team uses GitBook, create new API tokens, rotate secrets for connected tools and integrations, and check your logs for the three IP addresses GitBook published. More broadly, audit old app credentials, since one misconfigured integration opened the door here.
GitBook ↗AI-assisted, reviewed by Sorted AI
▲ 0
0 comments