Start with Identity
Subscribe
Identity CVE · SAML

CVE-2025-23369GitHub Enterprise Server SAML bypass via libxml2 canonicalization

high
Product: GitHub Enterprise ServerVendor: GitHubCWE-347Disclosed: 2025-01-21Status: PatchedProtocol deep diveNVD ↗

What broke

GitHub Enterprise Server's SAML verifier trusted libxml2's canonicalization of the signed assertion. Canonicalization quirks let an attacker present XML that verifies one way and is interpreted another. The result is an authentication bypass on self-hosted GitHub SSO. GitHub shipped a patched GHES release.

Why it matters

GHES is often the crown-jewel service provider in an enterprise: source, secrets in Actions, and production deploy keys. An SSO bypass there is not "just a forge login." It is a path to the codebase and the CI identity plane. The bug is also a reminder that XML DSig is only as strong as the canonicalizer you share with the attacker.

What to do

  • Apply the GHES security update that lists CVE-2025-23369. Confirm the version on every appliance, including DR.
  • If GHES SAML was reachable while unpatched, review new organization owners and PAT grants that have no matching IdP session.
  • Prefer OIDC to GitHub where you can. The OIDC path does not inherit this XML stack.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.