CVE-2026-4296
OAuth Redirect URI Bypass in GitHub Enterprise Server Enables Account Takeover
Publication date: 2026-04-21
Last updated on: 2026-04-29
Assigner: GitHub, Inc. (Products Only)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| github | enterprise_server | to 3.14.26 (exc) |
| github | enterprise_server | From 3.15.0 (inc) to 3.15.21 (exc) |
| github | enterprise_server | From 3.16.0 (inc) to 3.16.17 (exc) |
| github | enterprise_server | From 3.17.0 (inc) to 3.17.14 (exc) |
| github | enterprise_server | From 3.18.0 (inc) to 3.18.8 (exc) |
| github | enterprise_server | From 3.19.0 (inc) to 3.19.5 (exc) |
| github | enterprise_server | 3.20.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-185 | The product specifies a regular expression in a way that causes data to be improperly matched or compared. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an incorrect regular expression issue in GitHub Enterprise Server that allows an attacker to bypass OAuth redirect URI validation.
An attacker who knows the registered callback URL of a first-party OAuth application can create a malicious authorization link.
When a victim clicks this link, the OAuth authorization code is redirected to a domain controlled by the attacker.
This enables the attacker to gain unauthorized access to the victim's account with the permissions granted to the OAuth application.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to user accounts on GitHub Enterprise Server.
An attacker can exploit this flaw to obtain OAuth authorization codes and use them to access victim accounts with the same scopes as the OAuth application.
This could result in data exposure, unauthorized actions, and potential compromise of sensitive information within the affected accounts.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your GitHub Enterprise Server to one of the fixed versions: 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, or 3.14.26.