September 19, 2024 at 05:16PM Organizations using self-hosted GitLab instances with SAML-based authentication are advised to urgently update to the latest versions due to a severe bug (CVE-2024-45409) allowing attackers to bypass authentication checks and gain unauthorized access. GitLab has already updated managed instances but urges self-managed installations to patch immediately to mitigate the vulnerability. … Read more
September 19, 2024 at 01:36AM GitLab released patches to address a critical flaw in both Community and Enterprise Editions, rooted in the ruby-saml library, allowing an authentication bypass. The vulnerability affects single sign-on security, prompting the update of dependencies and urging self-managed installations to enable two-factor authentication as a mitigation. Threat indicators suggest active exploitation … Read more
May 21, 2024 at 01:22PM GitHub has addressed a critical flaw (CVE-2024-4985) in GitHub Enterprise Server, allowing unauthorized access on instances using SAML SSO with encrypted assertions. The issue affects versions prior to 3.13.0 and has been fixed in versions 3.9.15, 3.10.12, 3.11.10, and 3.12.4. Organizations using vulnerable versions are advised to update for security. … Read more
April 10, 2024 at 04:24PM Authentication protocols are essential for online security, allowing users to securely confirm their identities and access protected information. Selecting the right protocol can be daunting, but key options include OAuth/OpenID Connect for quick user registrations, SAML for enterprise single sign-on, FIDO2/WebAuthn for consumer-facing applications, and TOTP for enhanced security in … Read more