GitHub: Unauthorized Disabling of Mandatory Two-Factor Authentication

GitHub audit logs provide visibility into identity-control changes that impact organization and enterprise security. Specifically, the actions 'business.disable_two_factor_requirement' and 'org.disable_two_factor_requirement' indicate that the enforced 2FA requirement has been removed. This change downgrades all members within the affected scope to password-only authentication and allows the invitation of new accounts without 2FA, significantly increasing the risk of unauthorized access, persistence, and data exfiltration. This activity is often a precursor to further malicious operations following an initial account takeover of an owner or enterprise-admin account.

Impact

Removing the mandatory 2FA requirement immediately degrades the security posture of an entire GitHub organization or enterprise. Attackers may leverage this control change to maintain password-based persistence, facilitate the addition of attacker-controlled accounts with reduced friction, and bypass identity verification for subsequent high-impact modifications such as token generation, SSH key additions, or repository modifications.

Recommendation

• Immediately audit current GitHub organization and enterprise security settings to confirm that 'Require 2FA' is enabled for all members.
• Establish automated alerting for any occurrence of the 'business.disable_two_factor_requirement' or 'org.disable_two_factor_requirement' audit events.
• Conduct an immediate review of audit logs for any identity-related changes (e.g., new owner/member additions, PAT or OAuth app grants, SSH key updates) occurring immediately following a 2FA disablement event.
• Implement a break-glass policy for emergency access that requires documented change-management tickets for any temporary security control bypasses.
• Force a sign-out of all active sessions and require mandatory re-enrollment in 2FA for all organization members if a disablement event is identified as unauthorized.