An incorrect regular expression in GitHub Enterprise Server allowed an attacker to bypass OAuth redirect URI validation, enabling the malicious crafting of an authorization link that redirects the OAuth authorization code to any domain controlled by the attacker. The effect of this flaw is that an attacker can obtain the victim’s OAuth authorization code and, with the scopes granted to the application, gain unauthorized access to the victim’s account. The vulnerability is a type of input validation failure, classified as CWE‑185, and results in a compromise of account integrity and confidentiality.

All GitHub Enterprise Server versions prior to 3.21 are impacted, except for the patched releases 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26, which contain the fix.

The CVSS severity is 7.5, indicating a high‑impact vulnerability. EPSS data is not available, but the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation to date. An attacker, however, would need to know the registered callback URL of a first‑party OAuth application, and the victim must click the crafted link. Based on the description, the attack vector is likely social engineering via a malicious link, with authentication bypass as the outcome.