GitHub Resets User Sessions Following Rare Authentication Flaw

On March 8, GitHub invalidated all authenticated sessions on GitHub.com that were created before 12:03 UTC that day. The company took the precautionary step after discovering an extremely rare security vulnerability that affected a very small number of user sessions.

The issue first came to light on March 2, when an external party reported anomalous behavior in their authenticated GitHub.com session. GitHub's Security and Engineering teams began investigating immediately, patched the vulnerability on March 5, and deployed a second hardening patch on March 8.

Root Cause and Impact

At the heart of the problem was a race condition in a backend request handling process. In rare circumstances, the flaw could misroute a user's session to the browser of another authenticated user, thereby handing that user a valid, authenticated session cookie for someone else's account.

GitHub was explicit that the issue was not caused by compromised passwords, SSH keys, or personal access tokens (PATs), and there was no evidence that any other GitHub systems were compromised. The company also stated that the bug could not be intentionally triggered or directed by a malicious user.

The underlying bug existed on GitHub.com intermittently for a cumulative period of under two weeks between February 8 and March 5, 2021. GitHub believes the session misrouting occurred in fewer than 0.001% of authenticated sessions on the platform. No other GitHub properties or products, including GitHub Enterprise Server, were affected.

Precautionary Measures

Rather than risk the possibility that undetected compromised sessions remained after the patch, GitHub chose to invalidate all pre-March 8 sessions out of an abundance of caution. Affected users have been individually contacted with additional information and guidance.

Users are advised to log back in at any time. Anyone experiencing an account lockout due to an inability to complete the MFA challenge when logging back in should use GitHub's account recovery process. GitHub has indicated it will publish a full root cause analysis of the bug, and has since released an in-depth look at how the vulnerability was found and fixed.