CVE-2026-4296: We found a bug that could takeover Github repositories through…

CVE-2026-4296 could divert a GitHub Enterprise Server user's OAuth authorization code to an attacker. OAuth lets an application obtain specified permissions on a user's account. The advisory describes a faulty address-matching rule that allowed a crafted authorization link to send the code to an attacker-controlled destination when the victim clicked it. An attacker also needed to know the application's registered callback address.

The resulting access depended on the permissions granted to the affected application. Repository compromise was therefore a possible consequence of stolen authorization, rather than unconditional control over every repository. GitHub records the correction among the security fixes in Enterprise Server 3.20.1.