GitHub Enterprise Server Authentication Bypass Vulnerability Allowing Unauthenticated User Account Creation

A vulnerability in GitHub Enterprise Server (GHES) was identified that allows an unauthenticated attacker to create a local user account on an instance configured with an external authentication provider. This bypasses the identity provider validation, as the signup endpoint failed to properly enforce authentication restrictions. The created account is assigned default base permissions. Exploitation requires network access to the GHES instance with external authentication enabled.

Impact

Exploitation of this vulnerability allows for unauthorized account creation, bypassing external authentication providers, and could lead to unauthorized access to repositories, depending on the permissions assigned to the created account.

Remediation

Users can upgrade to GitHub Enterprise Server versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, or 3.16.18.