Impact

Unauthorized access to recovery codes allows an attacker to bypass federated authentication and MFA, enabling persistent, unauthenticated access to the GitHub enterprise or organization environment.

Recommendation

• Implement monitoring for GitHub audit logs specifically filtering for recovery code lifecycle events (download, generate, print, view, use, and failure).
• Enforce dual-control procedures for the management of recovery codes, ensuring that any lifecycle event is tied to an authorized disaster recovery process.
• Rotate recovery codes immediately if an unauthorized generation or viewing event is identified.
• Review SSO configuration and force re-authentication of enterprise owners following any confirmed compromise of recovery credentials.