Start with Identity
Subscribe
Identity CVE · SAML

CVE-2024-6800GitHub Enterprise Server SAML XML signature wrapping

high
Product: GitHub Enterprise ServerVendor: GitHubCWE-347Disclosed: 2024-08-20Status: PatchedProtocol deep diveNVD ↗

What broke

GitHub Enterprise Server accepted a wrapped SAML signature. An attacker with direct network access to the instance could forge a response and provision a privileged user. August 2024. Same family as CVE-2024-4985 and the later CVE-2025-23369 canonicalization bug.

Why it matters

Three GHES SAML IDs in one year is not bad luck. Encrypted assertions plus XML DSig is a surface GitHub kept getting wrong, which is why they later funded the ruby-saml review that found CVE-2024-45409's descendants.

What to do

  • Take the August 2024 GHES security update with the May and October SAML fixes.
  • Inventory every GHES ACS. DR and lab appliances count.
  • If you build a custom SAML SP, do not copy GHES's encrypted-assertion path. Read the SAML 2.0 pitfalls first.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.