OAuth Redirect URI Validation Bypass in GitHub Enterprise Server

CVE-2026-4296

What is CVE-2026-4296?

An issue exists within GitHub Enterprise Server that stems from an incorrect regular expression, enabling attackers to bypass OAuth redirect URI validation. By targeting a specific OAuth application's registered callback URL, an attacker might create a malicious authorization link. When a user clicks this link, they can be redirected to an attacker-controlled domain, putting their account's scopes at risk. Users are advised to upgrade to the latest versions to mitigate this vulnerability.

References