CVE-2026-54603CWE-200CWE-601information-disclosure

CVE-2026-54603

High · published July 28, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
38.0
In the wild
Unconfirmed
What it is

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Client#request overrides the request authority, so the bearer Authorization header is sent to an attacker-controlled host, leaking the credential. This issue is fixed in version 2.0.22.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00448 · 38.0th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-07-28T21:16Z
References (5)
https://github.com/ruby-oauth/oauth2/commit/0f0a474f1b38453e119e660c2daca742d4378ce9 · [email protected]https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.22 · [email protected]https://github.com/ruby-oauth/oauth2/security/advisories/GHSA-pp92-crg2-gfv9 · [email protected]https://lists.debian.org/debian-lts-announce/2026/10/msg00014.html · af854a3a-2127-422b-91ae-364da2661108https://github.com/ruby-oauth/oauth2/security/advisories/GHSA-pp92-crg2-gfv9 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 JUL 16:29Z
    OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host
    cvelistv5