GitHub bug saw users logged into others users’ accounts
The Microsoft-owned firm invalidated all authenticated sessions “out of an abundance of caution”
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
You are now subscribed
Your newsletter sign-up was successful
GitHub was forced to log out some of its users to protect others against a potentially serious security flaw.
According to a GitHub blog post on March 8, it invalidated all authenticated sessions on GitHub “out of an abundance of caution” to protect users.
Earlier in the month, GitHub received an external report of anomalous behavior for their authenticated GitHub user session. Once GitHub received the report, its security and engineering teams began to investigate the bug’s cause and impact.
GitHub found the bug was due to a rare condition in a backend request handling process that could have misrouted a user’s session to a different authenticated user’s browser, giving them another user’s valid and authenticated session cookie.
GitHub said the problem wasn’t the result of compromised account passwords, SSH keys, or personal access tokens (PATs), and there’s no evidence to suggest this was the result of a compromise of any other GitHub systems.
“Instead, this issue was due to the rare and isolated improper handling of authenticated sessions. Further, this issue could not be intentionally triggered or directed by a malicious user,” said Mike Hanley, CSO at GitHub.
He added that the underlying bug existed on GitHub for a cumulative period of fewer than two weeks at various times between February 8 and March 5.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
“Once the root cause was identified and a fix developed, we immediately patched GitHub.com on March 5. A second patch was deployed on March 8 to implement additional measures to further harden our application from this type of bug,” added Hanley.
He said that there was no indication the bug affected any other GitHub properties or products, including GitHub Enterprise Server, and added the session misrouting occurred in fewer than 0.001% of authenticated sessions on GitHub.
Hanley said for the few users who the bug affected, GitHub has contacted them with additional information and guidance. He added that users should now log back in and follow the company’s security best practices for users and organizations.
GitHub promised to share the findings of its investigations and the issue’s root cause analysis “in the coming weeks.”
Rene Millman is a freelance writer and broadcaster who covers cybersecurity, AI, IoT, and the cloud. He also works as a contributing analyst at GigaOm and has previously worked as an analyst for Gartner covering the infrastructure market. He has made numerous television appearances to give his views and expertise on technology trends and companies that affect and shape our lives. You can follow Rene Millman on Twitter.
-
What’s the role of IT operations management in improving infrastructure visibility?ITOM can map out hardware and software dependencies, bringing order to chaotic IT infrastructure
-
Why Google DeepMind’s AlphaGo breakthrough paved the way for the generative AI revolutionNews AlphaGo's victory over Go champion Lee Sedol in 2016 gave a "definitive preview of the AI era" and laid the groundwork for today's powerful tools.
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
An AWS CodeBuild vulnerability could’ve caused supply chain chaos – luckily a fix was applied before disaster struckNews A single misconfiguration could have allowed attackers to inject malicious code to launch a platform-wide compromise
-
Shai-Hulud malware is back with a vengeance and has hit more than 19,000 GitHub repositories so far — here's what developers need to knowNews The malware has compromised more than 700 widely-used npm packages, and is spreading fast
-
GitHub is awash with leaked AI company secrets – API keys, tokens, and credentials were all found out in the openNews Wiz research suggests AI leaders need to clean up their act when it comes to secrets leaking
-
Organizations urged to act fast after GitHub Action supply chain attackNews More than 20,000 organizations may be at risk following a supply chain attack affecting tj-actions/changed-files GitHub Action.
-
Nearly a million devices were infected in a huge GitHub malvertising campaignNews Microsoft has alerted users to a malvertising campaign leveraging GitHub to infect nearly 1 million devices around the world.
-
'GitVenom' campaign uses dodgy GitHub repositories to spread malwareNews Security researchers have issued an alert over a campaign using GitHub repositories to distribute malware, with users lured in by fake projects.
-
Malicious GitHub repositories target users with malwareNews Criminals are exploiting GitHub's reputation to install Lumma Stealer disguised as game hacks and cracked software
