GitHub Enterprise Server Flaw Lets Attackers Steal Admin Credentials

Executive Summary

A reflected HTML injection vulnerability in the GitHub Enterprise Server Management Console login page, tracked as CVE-2026-8106, could allow an unauthenticated attacker to steal administrator credentials. The flaw resides in the /setup/unlock endpoint, where the redirect_to query parameter is reflected into an HTML attribute without proper sanitization. An attacker can inject a malicious form element that, when rendered by the victim's browser, captures credentials entered by an administrator. GitHub addressed the issue in Enterprise Server version 3.19.6, released as part of the product's regular update cycle. No CVSS score has been published by GitHub as of this writing, but the vulnerability enables credential theft against a privileged interface, warranting urgent patching for self-hosted instances.

Technical Analysis

According to GitHub's release notes for Enterprise Server 3.19.6, the vulnerability is a reflected HTML injection affecting the Management Console login page. The redirect_to parameter on the /setup/unlock endpoint is inserted into an HTML attribute without encoding or validation. An attacker can craft a URL containing a malicious redirect_to value that closes the existing HTML attribute and injects a <form> element pointing to an attacker-controlled server. When an administrator visits the crafted URL and submits credentials on the legitimate-looking login page, the form data is sent to the attacker's destination.

The attack requires no authentication and can be delivered via phishing email, social engineering, or by embedding the crafted link on a compromised website that an administrator might visit. The GitHub Enterprise Server Management Console is typically exposed on a separate port (8443 by default) and is used for initial setup, configuration changes, and troubleshooting — making it a high-value target for attackers seeking persistent access to an organization's code infrastructure.

GitHub's advisory notes that exploitation requires an administrator to click the malicious link and then enter credentials. The injection is reflected, meaning the payload is not stored on the server — it is delivered as part of the URL itself. This limits the attack window to the duration of the administrator's session but does not require any prior compromise of the GitHub instance.

The fix, included in version 3.19.6, properly sanitizes the redirect_to parameter before reflecting it into the HTML response. GitHub did not disclose whether the vulnerability was discovered internally or reported by an external researcher. No evidence of active exploitation in the wild has been reported as of May 8, 2026.

Mitigations & Recommendations

Administrators running self-hosted GitHub Enterprise Server instances should upgrade to version 3.19.6 or later immediately. GitHub's release notes indicate the fix is included in the 3.19.6 release train; organizations on older release series (3.18.x, 3.17.x) should consult the upgrade path documentation to determine the appropriate patched version for their deployment.

For organizations unable to patch immediately, restricting network access to the Management Console interface (typically port 8443) to a limited set of administrative workstations via firewall rules or VPN can reduce the attack surface. Administrators should also be trained to scrutinize URLs before clicking, particularly those directing to the Management Console login page. Enabling multi-factor authentication (MFA) for Management Console access — where supported — would mitigate credential theft even if an attacker captures a password.