CVE Explorer
CVE-2026-4296
An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a malicious authorization link that, when clicked by a victim, would redirect the OAuth authorization code to an attacker-controlled domain. This could allow the attacker to gain unauthorized access to the victim's account with the scopes grante
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"affected","product":"Enterprise Server","vendor":"GitHub","versions":[{"changes":[{"at":"3.14.26","status":"unaffected"}],"lessThanOrEqual":"3.14.25","status":"affected","version":"3.14.0","versionType":"semver"},{"changes":[{"at":"3.15.21","status":"unaffected"}],"lessThanOrEqual":"3.15.20","status":"affected","version":"3.15.0","versionType":"semver"},{"changes":[{"at":"3.16.17","status":"unaffected"}],"lessThanOrEqual":"3.16.16","status":"affected","version":"3.16.0","versionType":"semver"},{"changes":[{"at":"3.17.14","status":"unaffected"}],"lessThanOrEqual":"3.17.13","st…
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:d8f1d1c14690d9daeb84173cd193a2a9bffa3f0040202fd5d3dcd50237c2cc9a · sha256:e3371b49d3d3d627… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":7.5,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpa…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:d8f1d1c14690d9daeb84173cd193a2a9bffa3f0040202fd5d3dcd50237c2cc9a · sha256:e3371b49d3d3d627… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-185","description":"CWE-185 Incorrect Regular Expression","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:d8f1d1c14690d9daeb84173cd193a2a9bffa3f0040202fd5d3dcd50237c2cc9a · sha256:e3371b49d3d3d627… · /containers/cna/problemTypes/0/descriptions/0
Source references
7 source assertions{"tags":["release-notes"],"url":"https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d8f1d1c14690d9daeb84173cd193a2a9bffa3f0040202fd5d3dcd50237c2cc9a · sha256:e3371b49d3d3d627… · /containers/cna/references/0
{"tags":["release-notes"],"url":"https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d8f1d1c14690d9daeb84173cd193a2a9bffa3f0040202fd5d3dcd50237c2cc9a · sha256:e3371b49d3d3d627… · /containers/cna/references/1
{"tags":["release-notes"],"url":"https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d8f1d1c14690d9daeb84173cd193a2a9bffa3f0040202fd5d3dcd50237c2cc9a · sha256:e3371b49d3d3d627… · /containers/cna/references/2
{"tags":["release-notes"],"url":"https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d8f1d1c14690d9daeb84173cd193a2a9bffa3f0040202fd5d3dcd50237c2cc9a · sha256:e3371b49d3d3d627… · /containers/cna/references/3
{"tags":["release-notes"],"url":"https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d8f1d1c14690d9daeb84173cd193a2a9bffa3f0040202fd5d3dcd50237c2cc9a · sha256:e3371b49d3d3d627… · /containers/cna/references/4
{"tags":["release-notes"],"url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d8f1d1c14690d9daeb84173cd193a2a9bffa3f0040202fd5d3dcd50237c2cc9a · sha256:e3371b49d3d3d627… · /containers/cna/references/5
{"tags":["release-notes"],"url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d8f1d1c14690d9daeb84173cd193a2a9bffa3f0040202fd5d3dcd50237c2cc9a · sha256:e3371b49d3d3d627… · /containers/cna/references/6
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.