CVE-2026-6736

An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce the authentication restriction, allowing account creation and session establishment without identity provider validation. The created account was limited to the default base permissions configured on the instance. Exploitation required network access to a GHES instance configured with an external authentication provider. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18.

• CWE-306

• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6Release Notes, Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2Release Notes, Vendor Advisory

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-67352luci-app-https-dns-proxy contains a stored cross-site script…7.6
• CVE-2026-67353guzzlehttp/guzzle versions before 7.15.1 contain a denial of…6.9
• CVE-2026-67354guzzlehttp/guzzle versions before 7.15.1 contain an informat…8.2
• CVE-2026-67355guzzlehttp/guzzle versions before 7.15.1 fail to preserve ho…8.2
• CVE-2026-67356ArcadeDB before 26.7.3 binds the real LocalDatabase object i…8.8
• CVE-2026-67357ArcadeDB versions before 26.7.3 contain an information discl…7.7
• CVE-2026-6737An Exposed IOCTL with Insufficient Access Control vulnerabil…2
• CVE-2026-6739Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.1…7.2
• CVE-2026-6740The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Webs…6.4
• CVE-2026-6741The LatePoint – Calendar Booking Plugin for Appointments and…8.8
• CVE-2026-6742The Advanced iFrame plugin for WordPress is vulnerable to St…6.4
• CVE-2026-67422pymdown-extensions is a collection of extensions for the Pyt…7.5