---
id: 9267
title: "GitHub Enterprise SAML Authentication Bypass (CVE-2024-4985 / CVE-2024-9487)"
source_domain: projectdiscovery.io
source_url: "https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass"
published_at: "2024-11-12T00:26:41Z"
tags: ["bug-bounty"]
phying_url: "https://phying.com/item/9267"
lang: en
---

# GitHub Enterprise SAML Authentication Bypass (CVE-2024-4985 / CVE-2024-9487)

## Summary

Introduction In light of the recent Ruby-SAML bypass discovered in GitLab, we set out to examine the SAML implementation within GitHub Enterprise. During our research, we identified a significant vulnerability that enabled bypassing GitHub’s SAML authentication when encrypted assertions were in use. This blog post will provide an in-depth look at GitHub Enterprise’s SAML implementation and analyze the specific code issue that permitted this bypass. Although we uncovered this vulnerability inde

## Intelligence Metadata

- **Sources:** projectdiscovery.io
- **Published:** 2024-11-12T00:26:41Z
- **Original:** https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
- **Phying News:** https://phying.com/item/9267