GitHub Enterprise Server up to 3.18.x/3.19.5/3.20.1/3.20.x /setup/unlock redirect_to cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, has been found in GitHub Enterprise Server up to 3.18.x/3.19.5/3.20.1/3.20.x. Impacted is the function redirect_to of the file /setup/unlock. Performing a manipulation results in cross site scripting. This vulnerability is identified as CVE-2026-8106. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in GitHub Enterprise Server up to 3.18.x/3.19.5/3.20.1/3.20.x. This affects the function redirect_to of the file /setup/unlock. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The redirect_to query parameter on the /setup/unlock endpoint was reflected into an HTML attribute without proper sanitization, enabling an attacker to inject a form element that could capture administrator credentials. Exploitation required an administrator to click a crafted link and enter their credentials. This vulnerability affected GitHub Enterprise Server versions 3.19.1 through 3.19.5 and 3.20.0 through 3.20.1, and was fixed in versions 3.19.6 and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program.

The weakness was released by maksyche. It is possible to read the advisory at docs.github.com. This vulnerability is uniquely identified as CVE-2026-8106 since 05/07/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation needs additional levels of successful authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

Upgrading to version 3.19.0 or 3.21.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1432). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Microsoft GitHub Enterprise

Productinfo

Type

• Bug Tracking Software

Vendor

• GitHub

Name

• Enterprise Server

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.19.0
• 3.19.1
• 3.19.2
• 3.19.3
• 3.19.4
• 3.19.5
• 3.20
• 3.20.0
• 3.20.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion