CVE-2024-9487GitHub Enterprise Server SAML encrypted-assertion, incomplete fix
What broke
CVE-2024-9487 is the incomplete fix of CVE-2024-4985. GitHub Enterprise Server still accepted a crafted encrypted SAML assertion after the May patch. An attacker could bypass SSO and provision access. GitHub described the October update as further hardening of the encrypted-assertions feature.
Why it matters
Same class as the ruby-saml incomplete-fix train (CVE-2025-54572). "We patched GHES SAML in May" was not a closed ticket. Encrypted assertions stayed the weak mode.
What to do
- Confirm the October 2024 GHES security release, not only the May one.
- Disable encrypted assertions if you do not need them. Plain signed assertions with a single XML stack fail more obviously.
- Re-hunt site-admin provisioning from May through October 2024.
After you patch
A SAML bypass means the service provider accepted an assertion it should have rejected, so anyone who exploited it authenticated as a real user and left a normal-looking log line.
- Revoke every session issued by the affected service provider, then rotate its session signing keys. Patching stops new forgeries and does nothing about sessions already minted.
- Audit administrative accounts and group memberships for changes during the exposure window. Signing in as an administrator is the point of this class, and adding a second account is the standard persistence step.
- Rotate the identity provider signing certificate if the flaw involved signature validation, and confirm the service provider pins the expected certificate rather than trusting anything in the assertion.
- Check your own implementation for the same class: exact-match comparison on verification results, rejection of unexpected signature algorithms, and audience and recency checks on every assertion. See SAML 2.0 and SAML vs OIDC.
Sources
- NVD: CVE-2024-9487
- ProjectDiscovery, GitHub Enterprise SAML authentication bypass
Related identity CVEs
Related on Start with Identity
- CVEGitHub Enterprise Server SAML bypass via libxml2 canonicalization
GitHub Enterprise Server accepted a crafted SAML response because libxml2 canonicalization quirks let the signed XML and the consumed XML diverge. High-severity
- CVEGitHub Enterprise Server SAML XML signature wrapping
A third 2024 GHES SAML path. An attacker with network access could wrap a signature and provision a privileged user. Same product, same year, same lesson: do no
- CVEFortinet follow-on SSO SAML bypass after the 59718 patch
A second FortiCloud SSO SAML bypass that hits devices already patched for CVE-2025-59718 and CVE-2025-59719. Actively exploited. CISA guidance 28 January 2026.
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- GlossaryIdentity Federation
A trust relationship between identity providers and service providers that lets users authenticate once at their home IdP and access applications at the other p
- GlossaryService Provider (SP)
The application that consumes identity assertions from an IdP to grant the user access. In SAML it's the SP; in OIDC the equivalent is the Relying Party. The se
Technique
This CVE is an instance of Federation trust abuse and SAML forgery. A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.