Which versions of GitHub Enterprise Server are affected by CVE-2026-4296?

GitHub Enterprise Server versions prior to 3.21 are vulnerable to account takeover through malicious OAuth redirect manipulation, threatening all users of GitHub-integrated applications.. A patch is available.

How to fix or mitigate CVE-2026-4296?

Within 24 hours, inventory all GitHub Enterprise Server instances and verify versions against the 3.21 threshold, identifying all downstream applications relying on GitHub OAuth. Within 7 days, obtain, test, and validate GitHub Enterprise Server 3.21 or later in a staging environment with application teams. Within 30 days, deploy the patched version to all production instances and perform post-upgrade validation of OAuth authentication flows.

GitHub Enterprise Server CVE-2026-4296

Q: What is the CVSS score of CVE-2026-4296?

CVE-2026-4296 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-24545 HIGH

Incorrect Regular Expression (CWE-185)

2026-04-21 product-cna@github.com

GHSA-mcp7-23p7-2v34

Authentication Bypass Enterprise Server

7.5

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Victim must click a crafted authorization link (UI:R) and attacker needs low-priv access plus the app's callback URL; stolen OAuth code grants account access (C:H/I:H) with no direct availability loss (A:N).

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:23 vuln.today

Patch released

Apr 29, 2026 - 12:39 nvd

Patch available

Apr 22, 2026 - 02:01 EUVD

EUVD ID Assigned

Apr 21, 2026 - 23:22 euvd

EUVD-2026-24545

CVE Published

Apr 21, 2026 - 23:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a malicious authorization link that, when clicked by a victim, would redirect the OAuth authorization code to an attacker-controlled domain. This could allow the attacker to gain unauthorized access to the victim's account with the scopes granted to the OAuth application. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.

AnalysisAI

Account takeover in GitHub Enterprise Server (all versions prior to 3.21) is possible through an OAuth redirect URI validation bypass caused by a flawed regular expression (CWE-185). An attacker who knows a first-party OAuth application's registered callback URL can craft a malicious authorization link that leaks the victim's OAuth authorization code to an attacker-controlled domain, granting access to the victim's account with the scopes of that application. Reported via the GitHub Bug Bounty program; there is no public exploit identified at time of analysis, EPSS is very low (0.05%), and CISA SSVC records exploitation status as none.

Technical ContextAI

The flaw sits in the OAuth 2.0 authorization-code flow of GitHub Enterprise Server, the self-hosted appliance version of GitHub. During authorization, the server must validate that the redirect_uri in an authorization request exactly matches the callback URL registered for the OAuth application. CWE-185 (Incorrect Regular Expression) means the validation regex was too permissive - likely unanchored or improperly escaping the URL structure - so a crafted redirect_uri that superficially matches the registered callback but points to an attacker domain passes validation. Because the authorization code is delivered to whatever redirect target survives validation, a regex weakness here directly translates into credential/token leakage. CPE data confirms the affected component is cpe:2.3:a:github:enterprise_server across the 3.14-3.20 branches, including the explicitly listed 3.20.0 build.

RemediationAI

Vendor-released patch: upgrade to GitHub Enterprise Server 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, or 3.14.26 depending on your branch - each is documented in the corresponding admin release notes (e.g., https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5 and the equivalent @3.14 through @3.20 pages). Upgrading the appliance is the definitive fix and should be prioritized because no in-product configuration toggle disables the vulnerable redirect-validation path. Until you can patch, compensating controls are limited but useful: audit and minimize the scopes granted to first-party OAuth applications so a leaked code yields the least access; review OAuth app registrations and, where feasible, tighten or rotate registered callback URLs to reduce the pool of abusable first-party apps; and educate/administratively warn users against clicking unexpected 'authorize' links, since exploitation requires victim interaction. These controls reduce blast radius and likelihood but do not close the underlying regex bypass, so they are stopgaps rather than a substitute for the upgrade.