Vulnerability is linked to an XML signature wrapping flaw in GitHub Enterprise Server (GHES) when using SAML authentication with certain identity providers.
Let's see how attacker can exploit it:

• XML Signature Wrapping: In this vulnerability, an attacker can exploit the way XML signatures are handled. They can manipulate the signed XML document in such a way that the server incorrectly interprets the data, allowing the attacker to insert malicious content while still appearing valid.

• Forging a SAML Response: The attacker, who must have network access to your GitHub server (either through your internal network, a VPN, or an exposed interface), can create a fake SAML authentication response. This forged response tricks the server into thinking that the attacker is a legitimate user.

• Gaining Admin Access: With this forged response, the attacker can bypass the usual authentication checks and gain unauthorized access to the GitHub server. Even worse, they can provision themselves or another account as a site administrator, giving them full control over the server.