PT-2026-65537 · Rubygems · Oauth2
CVE-2026-54603
·
Published
2026-07-28
·
Updated
2026-07-28
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
oauth2 versions 0.4.0 through 2.0.21
Description
A protocol-relative redirect in the
Location header returned to OAuth2::Client#request can override the request authority. This occurs because the method resolves redirects using URI#merge, which treats inputs starting with // as network-path references that replace the base URL authority. Consequently, the Authorization: Bearer header is sent to an attacker-controlled host, leading to cross-origin credential disclosure. Additionally, this can be used to perform Server-Side Request Forgery (SSRF) by forcing the application server to make requests to internal addresses. The issue is triggered when an attacker can influence the redirect target, such as through an open redirect on the Identity Provider (IdP), a malicious tenant-controlled IdP, or a compromised network proxy.Recommendations
Update oauth2 to version 2.0.22.
As a temporary mitigation, ensure that the
Location header is validated or neutralized by prepending ./ to values starting with // before they are processed by URI#merge in the OAuth2::Client#request function.Fix
Information Disclosure
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Oauth2