CVE-2026-54603
Description
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Client#request overrides the request authority, so the bearer Authorization header is sent to an attacker-controlled host, leaking the credential. This issue is fixed in version 2.0.22.
Summary dbcve.org
The OAuth2 Ruby gem (versions 0.4.0 to 2.0.21) contains a vulnerability in the Client#request method where protocol-relative redirect URLs (e.g., //malicious.com/oauth/callback) override the original request's authority. When the client follows this redirect, it sends the bearer Authorization header to the attacker-controlled host, resulting in OAuth credential leakage.
Mitigation
Upgrade the OAuth2 Ruby gem to version 2.0.22 or later to remediate the unsafe redirect handling. Review application logs for signs of unauthorized redirect following prior to the upgrade.