CVE-2026-4296
Full vulnerability record from the local CVENow database.
Description
An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a malicious authorization link that, when clicked by a victim, would redirect the OAuth authorization code to an attacker-controlled domain. This could allow the attacker to gain unauthorized access to the victim's account with the scopes granted to the OAuth application. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.
Severity
HIGH
CVSS score
7.5
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-21 23:16:21.807000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-4296",
"sourceIdentifier": "[email protected]",
"published": "2026-04-21T23:16:21.807",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a malicious authorization link that, when clicked by a victim, would redirect the OAuth authorization code to an attacker-controlled domain. This could allow the attacker to gain unauthorized access to the victim's account with the scopes granted to the OAuth application. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program."
},
{
"lang": "es",
"value": "Una vulnerabilidad de expresión regular incorrecta fue identificada en GitHub Enterprise Server que permitía a un atacante eludir la validación de URI de redirección de OAuth. Un atacante con conocimiento de la URL de devolución de llamada registrada de una aplicación OAuth de primera parte podría crear un enlace de autorización malicioso que, al ser clicado por una víctima, redirigiría el código de autorización de OAuth a un dominio controlado por el atacante. Esto podría permitir al atacante obtener acceso no autorizado a la cuenta de la víctima con los alcances concedidos a la aplicación OAuth. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a la 3.21 y fue corregida en las versiones 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. Esta vulnerabilidad fue reportada a través del programa GitHub Bug Bounty."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "GitHub",
"product": "Enterprise Server",
"defaultStatus": "affected",
"versions": [
{
"version": "3.14.0",
"lessThanOrEqual": "3.14.25",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.14.26",
"status": "unaffected"
}
]
},
{
"version": "3.15.0",
"lessThanOrEqual": "3.15.20",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.15.21",
"status": "unaffected"
}
]
},
{
"version": "3.16.0",
"lessThanOrEqual": "3.16.16",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.16.17",
"status": "unaffected"
}
]
},
{
"version": "3.17.0",
"lessThanOrEqual": "3.17.13",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.17.14",
"status": "unaffected"
}
]
},
{
"version": "3.18.0",
"lessThanOrEqual": "3.18.7",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.18.8",
"status": "unaffected"
}
]
},
{
"version": "3.19.0",
"lessThanOrEqual": "3.19.4",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.19.5",
"status": "unaffected"
}
]
},
{
"version": "3.20.0",
"lessThan": "3.20.1",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.20.1",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-22T13:16:42.627751Z",
"id": "CVE-2026-4296",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-185"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.14.26",
"matchCriteriaId": "72A92258-9FCC-41E0-856B-3C2A495575A6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.15.0",
"versionEndExcluding": "3.15.21",
"matchCriteriaId": "3A14A459-881C-437A-88EC-D721E3005329"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.0",
"versionEndExcluding": "3.16.17",
"matchCriteriaId": "8B7DCD9A-2CF0-4D96-AA96-ACEC662A8E1F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.17.0",
"versionEndExcluding": "3.17.14",
"matchCriteriaId": "CEC2ADE6-3E31-4889-9A73-B6695FE0AB52"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.0",
"versionEndExcluding": "3.18.8",
"matchCriteriaId": "9B15B12E-00A8-48E8-81DE-54506B94A2C5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.19.0",
"versionEndExcluding": "3.19.5",
"matchCriteriaId": "56903EAF-4579-4263-AB0F-863323E7C81A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:3.20.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DCA4F97D-688E-45D2-90C0-8A11E9B531AA"
}
]
}
]
}
],
"references": [
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.14.26",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.15.21",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.16.17",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.17.14",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.18.8",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.19.5",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.20.1",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
}
]
}