Cryptographic Signature Spoofing Vulnerability in GitHub Enterprise Server

CVE-2025-23369

Summary

An improper verification of cryptographic signature vulnerability was discovered in GitHub Enterprise Server, which permits unauthorized internal users to spoof signatures. This flaw affects all versions prior to 3.12.14, 3.13.10, 3.14.7, 3.15.2, and 3.16.0, notably impacting instances not employing SAML single sign-on. The report highlights the managing risk associated with internal threats and emphasizes the importance of updating affected systems to mitigate potential exploitation.

References