An authentication bypass vulnerability in GitHub Enterprise Server allowed unauthenticated attackers to create local user accounts despite external identity provider enforcement. This flaw existed in all versions prior to 3.21 and was fixed in several patch releases. The unauthorized accounts had default base permissions. Exploitation required network access to a vulnerable instance with external authentication enabled.