Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass
Summary
| CVE | CVE-2026-4296 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_P |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-04-21 23:16:21 UTC |
| Updated | 2026-04-29 12:39:18 UTC |
| Description | An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a malicious authorization link that, when clicked by a victim, would redirect the OAuth authorization code to an attacker-controlled domain. This could allow the attacker to gain unauthorized access to the victim's account with the scopes granted to the OAuth application. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program. |
Risk And Classification
Primary CVSS: v4.0 7.5 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.000500000 probability, percentile 0.154920000 (date 2026-04-22)
Problem Types: CWE-185 | CWE-185 CWE-185 Incorrect Regular Expression
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 7.5 | HIGH | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 7.5 | HIGH | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Primary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
PresentPrivileges Required
LowUser Interaction
PassiveConfidentiality
HighIntegrity
HighAvailability
HighSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Github | Enterprise Server | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | GitHub | Enterprise Server | affected 3.14.0 3.14.25 semver | Not specified |
| CNA | GitHub | Enterprise Server | affected 3.15.0 3.15.20 semver | Not specified |
| CNA | GitHub | Enterprise Server | affected 3.16.0 3.16.16 semver | Not specified |
| CNA | GitHub | Enterprise Server | affected 3.17.0 3.17.13 semver | Not specified |
| CNA | GitHub | Enterprise Server | affected 3.18.0 3.18.7 semver | Not specified |
| CNA | GitHub | Enterprise Server | affected 3.19.0 3.19.4 semver | Not specified |
| CNA | GitHub | Enterprise Server | affected 3.20.0 3.20.1 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| docs.github.com/en/[email protected]/admin/release-notes | [email protected] | docs.github.com | Release Notes, Vendor Advisory |
| docs.github.com/en/[email protected]/admin/release-notes | [email protected] | docs.github.com | Release Notes, Vendor Advisory |
| docs.github.com/en/[email protected]/admin/release-notes | [email protected] | docs.github.com | Release Notes, Vendor Advisory |
| docs.github.com/en/[email protected]/admin/release-notes | [email protected] | docs.github.com | Release Notes, Vendor Advisory |
| docs.github.com/en/[email protected]/admin/release-notes | [email protected] | docs.github.com | Release Notes, Vendor Advisory |
| docs.github.com/en/[email protected]/admin/release-notes | [email protected] | docs.github.com | Release Notes, Vendor Advisory |
| docs.github.com/en/[email protected]/admin/release-notes | [email protected] | docs.github.com | Release Notes, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: ahacker1 (en)
CNA: hacktron (en)
There are currently no legacy QID mappings associated with this CVE.