--- title: "GitBook SSO and production-access incident" description: "An SSO flaw led to GitBook staff-session and production access, exposing secrets and prompting a roughly sixteen-hour application outage." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-11-07" canonical_url: "https://www.ally.security/incidents/gitbook-sso-production-access-incident-2026" markdown_url: "https://www.ally.security/incidents/gitbook-sso-production-access-incident-2026.md" stix_url: "https://www.ally.security/incidents/gitbook-sso-production-access-incident-2026/stix.json" --- # GitBook SSO and production-access incident An SSO flaw led to GitBook staff-session and production access, exposing secrets and prompting a roughly sixteen-hour application outage. Last modified Nov 7, 2026 · 1 source ## Summary - **Environment:** Documentation platform and production infrastructure - **Operational impact:** Customer data treated as exposed; application outage - **Financial impact:** No quantified cost disclosed ## What happened [GitBook](https://www.gitbook.com/) disclosed staff-session and production-system access that exposed secrets and interrupted its documentation service. [1](#source-1) ## Impact GitBook treated all customer data as exposed, although it believed one customer was targeted. Potentially accessible material included API and integration secrets, session-signing secrets, Assistant questions and private documentation; this precaution does not establish that every item was copied. [1](#source-1) GitBook excluded billing information, passwords and IP addresses from the affected scope and reported no evidence of modification to other customers’ content. It could not determine actions in customer repositories accessible through authorized integrations. [1](#source-1) Disabling compromised service accounts caused an application outage from 20:32 UTC November 2 until 11:56 UTC November 3, with some cached public documentation available. Production access also recurred briefly on November 3. [1](#source-1) ## Timeline ### November 2, 2026 — Staff sessions and production infrastructure accessed An SSO flaw led to staff sessions and then production secrets; containment took the application offline. [Source account](https://www.gitbook.com/status/security-incident-2026-11-03). [1](#source-1) ### November 3, 2026 — Application restored after credential rotation The application returned at 11:56 UTC after response work; some production access had also recurred that day. [Source account](https://www.gitbook.com/status/security-incident-2026-11-03). [1](#source-1) ### November 4, 2026 — Postmortem published GitBook published the access chain, exposure assessment and customer credential-rotation instructions. [Source account](https://www.gitbook.com/status/security-incident-2026-11-03). [1](#source-1) ### November 7, 2026 — Briefing updated This briefing was last reviewed and updated on November 7, 2026. ## Threat Group & Attack Vector An attacker exploited a single-sign-on login flaw to obtain GitBook staff sessions, then accessed [GitHub](https://github.com/) App authentication information, internal code and a [Cloudflare](https://www.cloudflare.com/) API key. The chain exposed production secrets and service-account access. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - T1190 — [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/). [1](#source-1) ## Response GitBook fixed the SSO flaw, rotated production and integration keys, invalidated old API tokens and redeployed infrastructure. Customers were instructed to replace API tokens and rotate their own integration secrets and custom authenticated-backend signing keys. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### GitBook security incident and November 4 postmortem official · GitBook · Nov 4, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** GitBook SSO and production-access incident: Disabling compromised service accounts caused an application outage from 20:32 UTC November 2 until 11:56 UTC November 3, with some cached public documentation available. Production access also recurred briefly on November 3. 2. **Resulted In · 100% confidence · current** GitBook SSO and production-access incident: Postmortem published 3. **Resulted In · 100% confidence · current** GitBook SSO and production-access incident: Application restored after credential rotation 4. **Occurred At · 100% confidence · current** Application restored after credential rotation: 2026-11-03 5. **Affected Organization · 100% confidence · current** GitBook SSO and production-access incident: GitBook 6. **Began At · 100% confidence · current** GitBook SSO and production-access incident: 2026-11-02 7. **Resulted In · 100% confidence · current** GitBook SSO and production-access incident: GitBook excluded billing information, passwords and IP addresses from the affected scope and reported no evidence of modification to other customers’ content. It could not determine actions in customer repositories accessible through authorized integrations. 8. **Used Attack Technique · 95% confidence · current** GitBook SSO and production-access incident: https://attack.mitre.org/techniques/T1190/ 9. **Occurred At · 100% confidence · current** Staff sessions and production infrastructure accessed: 2026-11-02 10. **Resulted In · 100% confidence · current** GitBook SSO and production-access incident: Staff sessions and production infrastructure accessed 11. **Resulted In · 100% confidence · current** GitBook SSO and production-access incident: An attacker exploited a single-sign-on login flaw to obtain GitBook staff sessions, then accessed GitHub App authentication information, internal code and a Cloudflare API key. The chain exposed production secrets and service-account access. 12. **Occurred At · 100% confidence · current** Postmortem published: 2026-11-04 13. **Resulted In · 100% confidence · current** GitBook SSO and production-access incident: GitBook fixed the SSO flaw, rotated production and integration keys, invalidated old API tokens and redeployed infrastructure. Customers were instructed to replace API tokens and rotate their own integration secrets and custom authenticated-backend signing keys. 14. **Resulted In · 100% confidence · current** GitBook SSO and production-access incident: GitBook treated all customer data as exposed, although it believed one customer was targeted. Potentially accessible material included API and integration secrets, session-signing secrets, Assistant questions and private documentation; this precaution does not establish that every item was copied.