They insert a second, malicious SAML Assertion into the document," explains EndorLabs. "This malicious assertion contains the identity of a target user (e.g., an administrator's username)." ...

GitHub has fixed a maximum severity (CVSS v4 score: 10.0) authentication bypass vulnerability tracked as CVE-2024-4985, which impacts GitHub Enterprise Server (GHES) instances using SAML single ...