GitHub Device Code Phishing Explained: How It Works and How to Defend

Key takeaways

• The device flow (RFC 8628) was built for devices without a browser, such as CLIs and TVs.
• The attack tricks a person into authorising the attacker's app. No password is stolen and 2FA is completed by the victim.
• The real GitHub page is used, which is why it feels trustworthy. The app name and requested scopes are the clue.
• Never enter a code you did not start yourself. If you did, revoke the app and review your account activity.
• Organisations can restrict which OAuth apps are allowed.

What is the device authorisation flow?

Some programs cannot show a proper login page: a command-line tool, a smart TV, a build agent. The OAuth device flow, defined in RFC 8628, solves this. The program asks the service for a short user code and a verification URL. You open that URL on another device, type the code, log in, and approve the app. The program, meanwhile, polls the service until it receives an access token. GitHub's own steps are in its OAuth device flow documentation.

How is the flow abused?

The design has one weak point: the code links a request to an approval, but the service cannot tell whether the person approving it is the person who started the request. An attacker uses that gap.

1. The attacker registers or controls an OAuth app and starts a device flow, receiving a user code.
2. They send the victim a message, such as an email, chat or fake support note, saying the code is needed to "verify your account", join a repository, or finish a login.
3. The victim opens the genuine GitHub verification page, enters the code, signs in and completes two-factor authentication.
4. GitHub shows an authorisation screen for the attacker's app. If the victim clicks approve, the attacker's polling request receives a token.

The attacker never sees a password and never touches the 2FA step. The token carries whatever scopes (permissions) were granted, such as reading private repositories or writing to them. This is why defenders describe it as consent phishing rather than credential theft.

Does this bypass two-factor authentication?

Not technically. 2FA works correctly, because the real user performs it. What fails is the user's judgement about what they are authorising. That is why hardware keys and passkeys, which are excellent against fake login pages, do not by themselves stop this attack: the login happens on the real site.

What are the red flags?

• You are asked for a code you did not generate from your own terminal or device just now.
• The message creates urgency or comes from someone you cannot verify.
• The authorisation screen names an application you do not recognise, or asks for broad scopes such as full repository access or organisation access.
• The request arrives on a different channel from the tool it claims to belong to.

How do you protect yourself and your team?

Individuals: only enter a device code that your own command, for example gh auth login, just displayed on your screen. Read the app name and permissions before clicking authorise. Periodically review your authorised apps in GitHub settings and remove anything you do not use.

Organisations: use OAuth app access restrictions so members cannot grant org data to unapproved apps, review the audit log for new authorisations, prefer fine-grained tokens and GitHub Apps with narrow permissions, and train staff to treat code requests like a password request.

What should you do if you entered a code by mistake?

1. Go to your GitHub settings and open the list of authorised OAuth applications. Revoke the app you do not recognise.
2. Review recent account activity, SSH keys, personal access tokens and deploy keys for anything you did not create, and remove it.
3. If you work in an organisation, tell your security team so they can check the audit log for access to private repositories.
4. Rotate any secrets stored in repositories the app could read.

Next steps

Consent phishing is a good topic to study next to OAuth misconfiguration. You can read a real-world example of bypassing 2FA through OAuth misconfiguration and how common authentication mechanisms work. For structured training, see our cyber security course.

Related reading

• How attackers bypassed Gmail 2FA with app passwords, and how to protect yourself