CVE-2026-4296

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4296", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "state": "PUBLISHED", "assignerShortName": "GitHub_P", "dateReserved": "2026-03-16T17:48:03.040Z", "datePublished": "2026-04-21T22:12:45.356Z", "dateUpdated": "2026-04-22T13:16:53.004Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-04-21T22:12:45.356Z"}, "title": "Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-185", "description": "CWE-185 Incorrect Regular Expression", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "affected": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "version": "3.14.0", "lessThanOrEqual": "3.14.25", "changes": [{"at": "3.14.26", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.15.0", "lessThanOrEqual": "3.15.20", "changes": [{"at": "3.15.21", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.16.0", "lessThanOrEqual": "3.16.16", "changes": [{"at": "3.16.17", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.17.0", "lessThanOrEqual": "3.17.13", "changes": [{"at": "3.17.14", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.18.0", "lessThanOrEqual": "3.18.7", "changes": [{"at": "3.18.8", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.19.0", "lessThanOrEqual": "3.19.4", "changes": [{"at": "3.19.5", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.20.0", "lessThan": "3.20.1", "changes": [{"at": "3.20.1", "status": "unaffected"}], "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a malicious authorization link that, when clicked by a victim, would redirect the OAuth authorization code to an attacker-controlled domain. This could allow the attacker to gain unauthorized access to the victim's account with the scopes granted to the OAuth application. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a malicious authorization link that, when clicked by a victim, would redirect the OAuth authorization code to an attacker-controlled domain. This could allow the attacker to gain unauthorized access to the victim's account with the scopes granted to the OAuth application. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.<br>"}]}], "references": [{"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "ahacker1", "type": "finder"}, {"lang": "en", "value": "hacktron", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T13:16:42.627751Z", "id": "CVE-2026-4296", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:16:53.004Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4296", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-22T13:16:42.627751Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:16:47.875Z"}}], "cna": {"title": "Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "ahacker1"}, {"lang": "en", "type": "finder", "value": "hacktron"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "changes": [{"at": "3.14.26", "status": "unaffected"}], "version": "3.14.0", "versionType": "semver", "lessThanOrEqual": "3.14.25"}, {"status": "affected", "changes": [{"at": "3.15.21", "status": "unaffected"}], "version": "3.15.0", "versionType": "semver", "lessThanOrEqual": "3.15.20"}, {"status": "affected", "changes": [{"at": "3.16.17", "status": "unaffected"}], "version": "3.16.0", "versionType": "semver", "lessThanOrEqual": "3.16.16"}, {"status": "affected", "changes": [{"at": "3.17.14", "status": "unaffected"}], "version": "3.17.0", "versionType": "semver", "lessThanOrEqual": "3.17.13"}, {"status": "affected", "changes": [{"at": "3.18.8", "status": "unaffected"}], "version": "3.18.0", "versionType": "semver", "lessThanOrEqual": "3.18.7"}, {"status": "affected", "changes": [{"at": "3.19.5", "status": "unaffected"}], "version": "3.19.0", "versionType": "semver", "lessThanOrEqual": "3.19.4"}, {"status": "affected", "changes": [{"at": "3.20.1", "status": "unaffected"}], "version": "3.20.0", "lessThan": "3.20.1", "versionType": "semver"}], "defaultStatus": "affected"}], "references": [{"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a malicious authorization link that, when clicked by a victim, would redirect the OAuth authorization code to an attacker-controlled domain. This could allow the attacker to gain unauthorized access to the victim's account with the scopes granted to the OAuth application. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.", "supportingMedia": [{"type": "text/html", "value": "An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a malicious authorization link that, when clicked by a victim, would redirect the OAuth authorization code to an attacker-controlled domain. This could allow the attacker to gain unauthorized access to the victim's account with the scopes granted to the OAuth application. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-185", "description": "CWE-185 Incorrect Regular Expression"}]}], "providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-04-21T22:12:45.356Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4296", "state": "PUBLISHED", "dateUpdated": "2026-04-22T13:16:53.004Z", "dateReserved": "2026-03-16T17:48:03.040Z", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "datePublished": "2026-04-21T22:12:45.356Z", "assignerShortName": "GitHub_P"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Enterprise Server", "vendor": "GitHub", "versions": [{"changes": [{"at": "3.14.26", "status": "unaffected"}], "lessThanOrEqual": "3.14.25", "status": "affected", "version": "3.14.0", "versionType": "semver"}, {"changes": [{"at": "3.15.21", "status": "unaffected"}], "lessThanOrEqual": "3.15.20", "status": "affected", "version": "3.15.0", "versionType": "semver"}, {"changes": [{"at": "3.16.17", "status": "unaffected"}], "lessThanOrEqual": "3.16.16", "status": "affected", "version": "3.16.0", "versionType": "semver"}, {"changes": [{"at": "3.17.14", "status": "unaffected"}], "lessThanOrEqual": "3.17.13", "status": "affected", "version": "3.17.0", "versionType": "semver"}, {"changes": [{"at": "3.18.8", "status": "unaffected"}], "lessThanOrEqual": "3.18.7", "status": "affected", "version": "3.18.0", "versionType": "semver"}, {"changes": [{"at": "3.19.5", "status": "unaffected"}], "lessThanOrEqual": "3.19.4", "status": "affected", "version": "3.19.0", "versionType": "semver"}, {"changes": [{"at": "3.20.1", "status": "unaffected"}], "lessThan": "3.20.1", "status": "affected", "version": "3.20.0", "versionType": "semver"}]}], "source": "product-cna@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "72A92258-9FCC-41E0-856B-3C2A495575A6", "versionEndExcluding": "3.14.26", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "3A14A459-881C-437A-88EC-D721E3005329", "versionEndExcluding": "3.15.21", "versionStartIncluding": "3.15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B7DCD9A-2CF0-4D96-AA96-ACEC662A8E1F", "versionEndExcluding": "3.16.17", "versionStartIncluding": "3.16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "CEC2ADE6-3E31-4889-9A73-B6695FE0AB52", "versionEndExcluding": "3.17.14", "versionStartIncluding": "3.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B15B12E-00A8-48E8-81DE-54506B94A2C5", "versionEndExcluding": "3.18.8", "versionStartIncluding": "3.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "56903EAF-4579-4263-AB0F-863323E7C81A", "versionEndExcluding": "3.19.5", "versionStartIncluding": "3.19.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:3.20.0:*:*:*:*:*:*:*", "matchCriteriaId": "DCA4F97D-688E-45D2-90C0-8A11E9B531AA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a malicious authorization link that, when clicked by a victim, would redirect the OAuth authorization code to an attacker-controlled domain. This could allow the attacker to gain unauthorized access to the victim's account with the scopes granted to the OAuth application. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program."}, {"lang": "es", "value": "Una vulnerabilidad de expresi\u00f3n regular incorrecta fue identificada en GitHub Enterprise Server que permit\u00eda a un atacante eludir la validaci\u00f3n de URI de redirecci\u00f3n de OAuth. Un atacante con conocimiento de la URL de devoluci\u00f3n de llamada registrada de una aplicaci\u00f3n OAuth de primera parte podr\u00eda crear un enlace de autorizaci\u00f3n malicioso que, al ser clicado por una v\u00edctima, redirigir\u00eda el c\u00f3digo de autorizaci\u00f3n de OAuth a un dominio controlado por el atacante. Esto podr\u00eda permitir al atacante obtener acceso no autorizado a la cuenta de la v\u00edctima con los alcances concedidos a la aplicaci\u00f3n OAuth. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.21 y fue corregida en las versiones 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. Esta vulnerabilidad fue reportada a trav\u00e9s del programa GitHub Bug Bounty."}], "id": "CVE-2026-4296", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "product-cna@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4296", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T13:16:42.627751Z", "version": "2.0.3"}}]}, "published": "2026-04-21T23:16:21.807", "references": [{"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1"}], "sourceIdentifier": "product-cna@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-185"}], "source": "product-cna@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.14.0,3.14.25]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.15.0,3.15.20]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.16.0,3.16.16]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.17.0,3.17.13]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.18.0,3.18.7]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.19.0,3.19.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.20.0,3.20.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Enterprise Server", "source": "cna", "vendor": "GitHub"}, "product": "enterprise_server", "vendor": "github"}], "analysis": {"en": {"generated_at": "2026-04-22T06:18:18.852975+00:00", "value": {"mitigation_remediation": ["Upgrade GitHub Enterprise Server to any of the patched releases: 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, or 3.14.26.", "Revoke or disable any OAuth applications that may be vulnerable until the upgrade is completed to prevent further exploitation.", "Review all custom redirect URIs to ensure they match the expected domain exactly, and adjust configuration if necessary to eliminate future validation bypass opportunities."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized account access"}, "threat_synthesis": {"affected_systems": "All GitHub Enterprise Server versions prior to 3.21 are impacted, except for the patched releases 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26, which contain the fix.", "description_and_impact": "An incorrect regular expression in GitHub Enterprise Server allowed an attacker to bypass OAuth redirect URI validation, enabling the malicious crafting of an authorization link that redirects the OAuth authorization code to any domain controlled by the attacker. The effect of this flaw is that an attacker can obtain the victim\u2019s OAuth authorization code and, with the scopes granted to the application, gain unauthorized access to the victim\u2019s account. The vulnerability is a type of input validation failure, classified as CWE\u2011185, and results in a compromise of account integrity and confidentiality.", "risk_and_exploitability": "The CVSS severity is 7.5, indicating a high\u2011impact vulnerability. EPSS data is not available, but the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation to date. An attacker, however, would need to know the registered callback URL of a first\u2011party OAuth application, and the victim must click the crafted link. Based on the description, the attack vector is likely social engineering via a malicious link, with authentication bypass as the outcome."}}}}, "created": "2026-04-22T03:45:06.829211+00:00", "updated": "2026-04-22T06:30:10.666237+00:00", "vendors": ["github", "github$PRODUCT$enterprise_server"]}