CVE-2026-4296

OVERVIEW: CVE-2026-4296 is an incorrect regular expression vulnerability in GitHub Enterprise Server that allows attackers to bypass OAuth redirect URI validation. The flaw affects all versions prior to 3.21, with patches available in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. SEVERITY: An attacker with knowledge of a legitimate OAuth application's registered callback URL could craft a malicious authorization link to redirect the OAuth code to an attacker-controlled domain. This would grant the attacker unauthorized access to victim accounts with the scopes originally granted to the OAuth application. The attack requires user interaction and knowledge of a registered callback URL, though the FAUCET Risk Score of 38.0/100 indicates moderate concern. EXPLOITATION STATUS: There is no evidence of active exploitation in the wild. The vulnerability is not tracked on the Known Exploited Vulnerabilities catalog, community attention remains low as reflected by the inactive hot list status, and no publicly available exploit code has been reported. The extremely low EPSS score of 0.0005 further suggests minimal real-world exploitation activity at this time.