This vulnerability arises from an incorrect regular expression in GitHub Enterprise Server's OAuth redirect URI validation logic. It allows an attacker with knowledge of a first-party OAuth application's registered callback URL to bypass validation by crafting a malicious authorization link. When a victim clicks this link, the OAuth authorization code is redirected to an attacker-controlled domain, potentially granting the attacker unauthorized access to the victim's account with the OAuth application's scopes. The vulnerability affects versions prior to 3.21 and was addressed in multiple patch releases starting with 3.20.1.

Successful exploitation can lead to unauthorized access to user accounts on GitHub Enterprise Server with the permissions granted to the OAuth application. This could result in account compromise and unauthorized actions performed under the victim's identity. The vulnerability is rated high severity with a CVSS 4.0 score of 7.5, reflecting network attack vector, low attack complexity, and partial user interaction required.

A fix is available in GitHub Enterprise Server versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. Users should upgrade to one of these patched versions or later to remediate this vulnerability. Since this is not a cloud service, administrators must apply the update manually. Patch status is confirmed by the vendor advisory and the GitHub Bug Bounty program disclosure.