This vulnerability arises from an incorrect regular expression used in GitHub Enterprise Server's OAuth redirect URI validation, classified as CWE-185. It allows an attacker with knowledge of a first-party OAuth application's registered callback URL to create a malicious authorization link. When a victim clicks this link, the OAuth authorization code is redirected to an attacker-controlled domain, potentially granting the attacker unauthorized access to the victim's account with the permissions granted to the OAuth application. The vulnerability affects all GitHub Enterprise Server versions prior to 3.21 and was addressed in patch releases 3.14.26, 3.15.21, 3.16.17, 3.17.14, 3.18.8, 3.19.5, and 3.20.1. The vulnerability was responsibly disclosed via the GitHub Bug Bounty program.

Successful exploitation can lead to unauthorized access to user accounts on GitHub Enterprise Server with the OAuth application's granted scopes. This could result in account compromise and unauthorized actions performed under the victim's identity. The vulnerability requires user interaction (clicking a crafted link) and some level of attacker knowledge (the legitimate OAuth callback URL). No known active exploits have been reported.

A fix is available and has been released in GitHub Enterprise Server versions 3.14.26, 3.15.21, 3.16.17, 3.17.14, 3.18.8, 3.19.5, and 3.20.1. Users and administrators should upgrade affected GitHub Enterprise Server instances to one of these patched versions or later to remediate this vulnerability. Since this is not a cloud service, patching the server is required. Patch status is confirmed by the vendor advisory embedded in the description.