# CVE-2026-8106: Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft

> CVE-2026-8106: Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft. CVSS 6.1 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-8106
Last updated: 2026-06-17T11:03:29Z

- Published: 2026-05-07 21:18 UTC · Updated: 2026-06-17 11:03 UTC · Assigner: GitHub\_P
- CVSS: 6.1 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS: 0.16%, 6th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-79

## Description

A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The redirect\_to query parameter on the /setup/unlock endpoint was reflected into an HTML attribute without proper sanitization, enabling an attacker to inject a form element that could capture administrator credentials. Exploitation required an administrator to click a crafted link and enter their credentials. This vulnerability affected GitHub Enterprise Server versions 3.19.1 through 3.19.5 and 3.20.0 through 3.20.1, and was fixed in versions 3.19.6 and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program.

## Affected vendors and products

- GitHub: Enterprise Server

## Tracked companies

- [GitHub](https://rewindex.com/company/github.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-8106)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-8106)
- [https://docs.github.com/en/enterprise-server@3.19/admin/release-notes\#3.19.6](https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6)
- [https://docs.github.com/en/enterprise-server@3.20/admin/release-notes\#3.20.2](https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-8106 · Markdown: https://rewindex.com/cve/CVE-2026-8106.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-8106 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:12:02.751Z