CVE-2026-6736

An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce the authentication restriction, allowing account creation and session establishment without identity provider validation. The created account was limited to the default base permissions configured on the instance. Exploitation required network access to a GHES instance configured with an external authentication provider. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18.

• CWE-306

• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2Release Notes, Vendor Advisory

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-67354guzzlehttp/guzzle versions before 7.15.1 contain an informat…5.9
• CVE-2026-67355guzzlehttp/guzzle versions before 7.15.1 fail to preserve ho…5.9
• CVE-2026-67356ArcadeDB before 26.7.3 binds the real LocalDatabase object i…8.8
• CVE-2026-67357ArcadeDB versions before 26.7.3 contain an information discl…7.5
• CVE-2026-67358Joomla Extension - j2commerce.com - Download quota manipulat…5.3
• CVE-2026-67359Joomla Extension - j2commerce.com - Order content disclosure…8.7
• CVE-2026-67360Joomla Extension - j2commerce.com - Cross-customer order rep…6.3
• CVE-2026-67361Joomla Extension - j2commerce.com - Unauthenticated file upl…6.9
• CVE-2026-67362Joomla Extension - j2commerce.com - Open redirect in cart co…5.1
• CVE-2026-67363Joomla Extension - balbooa.com - Pre-auth Payment Amount Tam…7.7
• CVE-2026-67364Joomla Extension - balbooa.com - Pre-auth PHP Code Injection…10
• CVE-2026-67365Joomla Extension - icagenda.com - Unauthenticated SQL inject…9.2