Reflected HTML Injection Vulnerability in GitHub Enterprise Server Management Console

CVE-2026-8106

What is CVE-2026-8106?

A reflected HTML injection vulnerability has been discovered in the GitHub Enterprise Server Management Console login page. This flaw allows attackers to exploit the redirect_to query parameter on the /setup/unlock endpoint, which is reflected into an HTML attribute without adequate sanitization. By crafting a malicious link, an attacker could potentially capture administrator credentials when the targeted admin clicks the link and enters their credentials. This vulnerability affects multiple versions of GitHub Enterprise Server and poses significant security risks. Users should upgrade to the patched versions to mitigate potential threats.

References