Start with Identity
Subscribe
Identity CVE · SAML

CVE-2024-9487GitHub Enterprise Server SAML encrypted-assertion, incomplete fix

high
Product: GitHub Enterprise ServerVendor: GitHubCWE-347Disclosed: 2024-10-10Status: PatchedProtocol deep diveNVD ↗

What broke

CVE-2024-9487 is the incomplete fix of CVE-2024-4985. GitHub Enterprise Server still accepted a crafted encrypted SAML assertion after the May patch. An attacker could bypass SSO and provision access. GitHub described the October update as further hardening of the encrypted-assertions feature.

Why it matters

Same class as the ruby-saml incomplete-fix train (CVE-2025-54572). "We patched GHES SAML in May" was not a closed ticket. Encrypted assertions stayed the weak mode.

What to do

  • Confirm the October 2024 GHES security release, not only the May one.
  • Disable encrypted assertions if you do not need them. Plain signed assertions with a single XML stack fail more obviously.
  • Re-hunt site-admin provisioning from May through October 2024.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.