{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/github-enterprise/organization/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GitHub (Enterprise/Organization)"],"_cs_severities":["high"],"_cs_tags":["cloud","saas","credential-access","persistence"],"_cs_type":"advisory","_cs_vendors":["GitHub"],"content_html":"\u003cp\u003eGitHub provides recovery codes for enterprise and organization SSO as a contingency for IdP access loss. Because these codes bypass external identity providers and MFA, they represent high-value targets for adversaries seeking to establish persistence or perform account takeover. Organizations should audit all actions related to these credentials, including generation, downloading, viewing, and usage, to identify anomalous administrative behavior.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eUnauthorized access to recovery codes allows an attacker to bypass federated authentication and MFA, enabling persistent, unauthenticated access to the GitHub enterprise or organization environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement monitoring for GitHub audit logs specifically filtering for recovery code lifecycle events (download, generate, print, view, use, and failure).\u003c/li\u003e\n\u003cli\u003eEnforce dual-control procedures for the management of recovery codes, ensuring that any lifecycle event is tied to an authorized disaster recovery process.\u003c/li\u003e\n\u003cli\u003eRotate recovery codes immediately if an unauthorized generation or viewing event is identified.\u003c/li\u003e\n\u003cli\u003eReview SSO configuration and force re-authentication of enterprise owners following any confirmed compromise of recovery credentials.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-02T15:09:08Z","date_published":"2026-11-02T15:09:08Z","id":"https://feed.craftedsignal.io/briefs/2026-11-github-sso-recovery-code-monitoring/","summary":"GitHub SSO recovery codes act as break-glass credentials bypassing IdP-enforced MFA, and their unauthorized generation, access, or usage indicates potential credential access or persistence attempts.","title":"GitHub Enterprise and Organization SSO Recovery Code Activity","url":"https://feed.craftedsignal.io/briefs/2026-11-github-sso-recovery-code-monitoring/"}],"language":"en","title":"CraftedSignal Threat Feed - GitHub (Enterprise/Organization)","version":"https://jsonfeed.org/version/1.1"}