EUVD-2026-28461
GHSA-2gcr-p5w4-5hh8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionGitHub Advisory
An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce the authentication restriction, allowing account creation and session establishment without identity provider validation. The created account was limited to the default base permissions configured on the instance. Exploitation required network access to a GHES instance configured with an external authentication provider. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18.
AnalysisAI
GitHub Enterprise Server versions prior to 3.21 contain an authentication bypass vulnerability that allows unauthenticated attackers to create local user accounts and establish sessions without validation by the configured external identity provider. The vulnerability affects instances with external authentication enabled, permitting account creation via the signup endpoint with default base permissions. Attack requires only network access and affects all affected versions across the 3.16-3.20 branch.
Technical ContextAI
GitHub Enterprise Server supports external authentication providers (SAML, LDAP, OAuth) as a mechanism to centralize identity management and enforce access control policies. When external authentication is configured, the signup endpoint should restrict account creation to authenticated users validated against the identity provider. The vulnerability stems from inadequate enforcement of authentication restrictions in the signup flow (CWE-306: Missing Authentication for Critical Function), allowing the endpoint to process account creation requests without verifying identity provider validation. This bypass applies specifically to local account creation and does not affect accounts provisioned through the identity provider itself. The vulnerability is constrained by the attack timing requirement (AT:P in CVSS 4.0 vector), indicating temporal or ordering conditions that limit exploitation.
RemediationAI
Upgrade immediately to patched versions: 3.16.18, 3.17.15, 3.18.9, 3.19.6, or 3.20.2 depending on your current version branch. Patched versions are available in official GitHub release notes (see https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18 and equivalent URLs for other versions). Verify the upgrade in a test environment first to confirm external authentication enforcement is restored. As a temporary compensating control while patching, restrict network access to the GHES signup endpoint (e.g., /signup) to internal networks only via firewall or reverse proxy rules, blocking external access until patching is complete; this mitigates remote exploitation but does not prevent attacks from internal networks. Additionally, audit existing user accounts created during the vulnerability window (between deployment and patch application) and revoke any unauthorized accounts created outside the identity provider. Monitor authentication logs for signup endpoint requests from unexpected sources.
More in Enterprise Server
View allThe RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and
An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. R
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowe
An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sig
An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Ent
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL
An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server
An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted
An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication wi
Server-side request forgery in GitHub Enterprise Server lets an unauthenticated attacker coerce the appliance into issui
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor rol
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor rol
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today