GitHub Enterprise Server vulnerable to critical auth bypass flaw
A critical vulnerability affecting multiple versions of GitHub Enterprise Server could be exploited to bypass authentication and enable an attacker to gain administrator privileges on the machine.
The security issue is identified as CVE-2024-6800 and received a 9.5 severity rating as per the CVSS 4.0 standard. It is described as an XML signature wrapping problem that occurs when using the Security Assertion Markup Language (SAML) authentication standard with certain identity providers.
GitHub Enterprise Server (GHES) is a local version of GitHub for businesses that lack the experience for working with the public cloud or want to manage access and security controls.
According to the FOFA search engine for network assets exposed on the public web, there are more than 36,500 GHES instances accessible over the internet, most of them (29,200) located in the United States.
However, it is unclear how many of the exposed GHES machines are running a vulnerable version of the product.

GitHub has addressed the issue in GHES versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16.
The new GHES releases also include fixes for two other vulnerabilities, both with a medium severity score:
- CVE-2024-7711: allows issues on public repositories to be modified by attackers
- CVE-2024-6337: relates to disclosing issue content from a private repository
All three security issues were reported through GitHub's Bug Bounty program on the HackerOne platform.
GitHub warns that some services might show errors during the configuration process after applying the security updates but instance should still start correctly.
Several issues related to log entries, memory utilization, and service interruptions during specific operations are also noted in the bulletin, so system admins are advised to check the ‘Known issues’ section before they apply the update.
New macOS Malware TodoSwift Linked to North Korean Hacking Groups
August Windows security update breaks dual boot on Linux systems
CVE-2024-20439 Cisco Smart Licensing Utility Static Credential Vulnerability
CVE-2025-2783 Google Chromium Mojo Sandbox Escape Vulnerability
CVE-2019-9874 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVE-2019-9875 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVE-2025-30154 reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability
CVE-2025-1316 Edimax IC-7100 IP Camera OS Command Injection Vulnerability
CVE-2024-48248 NAKIVO Backup and Replication Absolute Path Traversal Vulnerability
CVE-2017-12637 SAP NetWeaver Directory Traversal Vulnerability
CVE-2025-24472 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
InformationalInformation Disclosure - Suspicious Comments
HighPII Disclosure
CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection
CWE-1256 Improper Restriction of Software Interfaces to Hardware Features
HighCWE-772 Missing Release of Resource after Effective Lifetime
CWE-303 Incorrect Implementation of Authentication Algorithm
CWE-435 Improper Interaction Between Multiple Correctly-Behaving Entities
Free online web security scanner