CVE-2026-4296: fallo de gravedad alta en GitHub Enterprise Server
Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.4%
An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a malicious authorization link that, when clicked by a victim, would redirect the OAuth authorization code to an attacker-controlled domain. This could allow the attacker to gain unauthorized access to the victim's account with the scopes granted to the OAuth application. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
GitHub · Enterprise ServerCVEs relacionadas — GitHub Enterprise Server
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-0200HIGHUnsafe Reflection in Github Enterprise Server leading to Command InjectionEPSS 71.7%CVE-2024-0507MEDIUMPrivilege Escalation by Code Injection in the Management Console in GitHub Enterprise ServerEPSS 65.8%CVE-2026-3854HIGHRemote code execution via git push option injection in GitHub Enterprise ServerEPSS 41.9%CVE-2024-9487CRITICALAn Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabledEPSS 25.6%CVE-2026-9312CRITICALServer-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpointEPSS 9.2%CVE-2024-1374CRITICALCommand injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement ConsoleEPSS 2.6%
Referencias
https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1