# CVE-2025-23369: Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation

- Exploited (CISA KEV): no
- Published: 2025-01-21
- CVSS: 7.6 HIGH (v4.0)
- EPSS: 1.6% (76th percentile)
- CWE: CWE-347

An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users.  Instances not utilizing SAML single sign-on or where the attacker is not already an existing user were not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12.14, 3.13.10, 3.14.7, 3.15.2, and 3.16.0. This vulnerability was reported via the GitHub Bug Bounty program.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-03-11 | 49 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2025-03-11 · new · rule 200013107
  > Added: signature 200013107 "Github Enterprise SAML Authentication Bypass" (Authentication/Authorization Attacks, risk High), systems: Other Web Server, Ruby. References: CVE-2025-23369.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-23369 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-23369