PT-2026-34209 · Github · Github Enterprise Server

Ahacker1 + 1 · Published 2026-04-21 · Updated 2026-04-26 · CVE-2026-4296

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21

Description An incorrect regular expression allows an attacker to bypass OAuth redirect URI validation. An attacker aware of a first-party OAuth application's registered callback URL can create a malicious authorization link. If a victim clicks this link, the OAuth authorization code is redirected to a domain controlled by the attacker, potentially granting unauthorized access to the victim's account based on the scopes granted to the OAuth application.

Recommendations Update to version 3.20.1 Update to version 3.19.5 Update to version 3.18.8 Update to version 3.17.14 Update to version 3.16.17 Update to version 3.15.21 Update to version 3.14.26

Fix

Weakness Enumeration

CWE-185

Related Identifiers

CVE-2026-4296

Affected Products

Github Enterprise Server

References · 10

• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4296 · Security Note
• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1 · Vendor Advisory
• https://twitter.com/CVEnew/status/2048481081851077112 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046863712938520774 · Twitter Post