CVE-2022-39304

ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum). This issue has been patched and is available in version 2.0.0.

• CWE-209

• https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps#authenticating-as-an-installationTechnical Description, Third Party Advisory
• https://github.com/bradleyfalzon/ghinstallation/blob/24e56b3fb7669f209134a01eff731d7e2ef72a5c/transport.go#L172-L174Exploit, Third Party Advisory
• https://github.com/bradleyfalzon/ghinstallation/commit/d24f14f8be70d94129d76026e8b0f4f9170c8c3ePatch, Third Party Advisory
• https://github.com/bradleyfalzon/ghinstallation/security/advisories/GHSA-h4q8-96p6-jcgrPatch, Third Party Advisory
• https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps#authenticating-as-an-installationTechnical Description, Third Party Advisory
• https://github.com/bradleyfalzon/ghinstallation/blob/24e56b3fb7669f209134a01eff731d7e2ef72a5c/transport.go#L172-L174Exploit, Third Party Advisory
• https://github.com/bradleyfalzon/ghinstallation/commit/d24f14f8be70d94129d76026e8b0f4f9170c8c3ePatch, Third Party Advisory
• https://github.com/bradleyfalzon/ghinstallation/security/advisories/GHSA-h4q8-96p6-jcgrPatch, Third Party Advisory

Published

Dec 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39299Passport-SAML is a SAML 2.0 authentication provider for Pass…8.1
• CVE-2022-3930The Directorist WordPress plugin before 7.4.2.2 suffers from…6.5
• CVE-2022-39300node SAML is a SAML 2.0 library based on the SAML implementa…8.1
• CVE-2022-39301sra-admin is a background rights management system that sepa…5.4
• CVE-2022-39302Ree6 is a moderation bot. This vulnerability would allow oth…5.4
• CVE-2022-39303Ree6 is a moderation bot. This vulnerability allows manipula…9.8
• CVE-2022-39305Gin-vue-admin is a backstage management system based on vue …9.8
• CVE-2022-39306Grafana is an open-source platform for monitoring and observ…8.1
• CVE-2022-39307Grafana is an open-source platform for monitoring and observ…5.3
• CVE-2022-39308GoCD is a continuous delivery server. GoCD helps you automat…5.9
• CVE-2022-39309GoCD is a continuous delivery server. GoCD helps you automat…6.5
• CVE-2022-3931Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…