CVE-2026-8106: Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft
A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The redirectto query parameter on the /setup/unlock endpoint was reflected into an HTML attribute without proper sanitization, enabling an attacker to inject a form element that could capture administrator credentials. Exploitation required an administrator to click a crafted link and enter their credentials. This vulnerability affected GitHub Enterprise Server versions 3.19.1 through 3.19.5 and 3.20.0 through 3.20.1, and was fixed in versions 3.19.6 and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitHub Enterprise Serverto a version that resolves this vulnerability.Fixed in 3.19.6 - Upgrade
Upgrade
GitHub Enterprise Serverto a version that resolves this vulnerability.Fixed in 3.20.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8106?
CVE-2026-8106 is considered a medium severity vulnerability due to its potential for credential theft.
How do I fix CVE-2026-8106?
To fix CVE-2026-8106, upgrade your GitHub Enterprise Server to versions 3.19.6 or 3.20.2 or later.
What software is affected by CVE-2026-8106?
CVE-2026-8106 affects GitHub Enterprise Server versions 3.19.1 to 3.19.5 and 3.20.0 to 3.20.1.
What type of vulnerability is CVE-2026-8106?
CVE-2026-8106 is a reflected HTML injection vulnerability that can exploit the login page.
What are the consequences of CVE-2026-8106?
The consequences of CVE-2026-8106 include potential credential theft from users accessing the management console.