Dashboard / CVE-2026-8106

CVE-2026-8106

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 62/100
Published: 2026-05-07 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Active
S: X
AT: Present
VC: High
VI: None
VA: None

Description

A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The redirect_to query parameter on the /setup/unlock endpoint was reflected into an HTML attribute without proper sanitization, enabling an attacker to inject a form element that could capture administrator credentials. Exploitation required an administrator to click a crafted link and enter their credentials. This vulnerability affected GitHub Enterprise Server versions 3.19.1 through 3.19.5 and 3.20.0 through 3.20.1, and was fixed in versions 3.19.6 and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
github enterprise_server 3.19.1 – 3.19.6
github enterprise_server 3.20.0 – 3.20.2

References & Advisories (2)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

5.9 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.16%
Raw Score 0.001640
Percentile 5.6%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00164
2026-10-28
0.00164

Intelligence Sources

nvd ref →

External Links