# HCSEC-2020-15 - Terraform Enterprise Allowed Local Account Creation Bypassing SSO **URL:** \ **Category:** Security\ **Tags:** security-terraform\ **Created:** [November 25, 2020, 8:15pm UTC](https://discuss.hashicorp.com/t/hcsec-2020-15-terraform-enterprise-allowed-local-account-creation-bypassing-sso/18100 "2020-11-25T20:15:09Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![jfinnigan](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jfinnigan/32/3834_2.png) [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\ **Post date:** [November 25, 2020, 8:15pm UTC](https://discuss.hashicorp.com/t/hcsec-2020-15-terraform-enterprise-allowed-local-account-creation-bypassing-sso/18100/1 "2020-11-25T20:15:09Z")
**Bulletin ID:** HCSEC-2020-15 **Affected Products / Versions:** Terraform Enterprise up to v202006-1; fixed in v202007-1. **Publication Date:** 2 July, 2020 **Summary** HashiCorp Terraform Enterprise up to v202006-1 contained a default signup page that allowed user registration even when disabled, bypassing SAML enforcement. This vulnerability, CVE-2020-15511, was fixed in v202007-1. **Background** Terraform Enterprise allowed single sign-on to be enabled via SAML ([documentation](https://www.terraform.io/docs/enterprise/saml/index.html)). **Details** It was observed that a default signup page was included within the Terraform Enteprise application that allowed user registration even when disabled, bypassing SAML enforcement. **Remediation** Upgrade to Terraform Enterprise v202007-1. **Acknowledgement** This issue was identified by Nick Frichette of State Farm Information Security, who reported it privately to HashiCorp. _We deeply appreciate any effort to discover and disclose security vulnerabilities responsibly. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security](https://hashicorp.com/security)._