Executive brief
A security vulnerability in the GitHub Enterprise Server Management Console could allow an attacker to steal administrator login credentials. By tricking an administrator into clicking a malicious link, an attacker can inject a fake login form into the legitimate management page. If the administrator enters their details into this injected form, their credentials could be captured by the attacker, potentially leading to full unauthorized control over the server instance.
Technical details
A reflected HTML injection vulnerability exists in the GitHub Enterprise Server Management Console due to improper sanitization of the 'redirect_to' query parameter on the '/setup/unlock' endpoint. This parameter is reflected into an HTML attribute, allowing an attacker to inject arbitrary HTML elements, such as a malicious form, into the page. To exploit this, an attacker must convince an authenticated administrator to click a specially crafted URL. Successful exploitation allows the attacker to capture sensitive credentials entered by the user. The issue is fixed in GitHub Enterprise Server versions 3.19.6 and 3.20.2.
Affected products
- GitHub Enterprise Server 3.19.1 - 3.19.5, 3.20.0 - 3.20.1
Timeline
- 2026-05-07: advisory: Initial advisory published by GitHub
- 2026-05-07: disclosed: Vulnerability reported via GitHub Bug Bounty program
- 2026-05-11: other: NIST initial analysis completed