CVE-2026-8106

Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft

State: Published
Severity: 5.9 Medium
Published: May 7, 2026
Updated: May 8, 2026
Reserved: May 7, 2026

Read the record on cve.org

Description

A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The redirect_to query parameter on the /setup/unlock endpoint was reflected into an HTML attribute without proper sanitization, enabling an attacker to inject a form element that could capture administrator credentials. Exploitation required an administrator to click a crafted link and enter their credentials. This vulnerability affected GitHub Enterprise Server versions 3.19.1 through 3.19.5 and 3.20.0 through 3.20.1, and was fixed in versions 3.19.6 and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program.

Scores

CVSS	Score	Vector	Source
4.0	5.9 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	GitHub_P

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Enterprise ServerGitHub	3.19.1 through 3.19.5Affectedfrom 3.19.6Not affected 3.20.0 through 3.20.1Affectedfrom 3.20.2Not affected 3.19.0Not affected 3.21.0Not affected

References

https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6release-notes
https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2release-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.