A vulnerability in GitLab CE/EE allows an attacker with Bitbucket account credentials to potentially take over a GitLab account linked to another user's Bitbucket account when Bitbucket is used as an OAuth 2.0 provider. This affects multiple GitLab versions from 7.8 up to but not including 16.9.6, 16.10 up to but not including 16.10.4, and 16.11 up to but not including 16.11.1. The issue is an authentication bypass caused by assumed-immutable data.