CVE-2026-54603
Received Received - Intake

OAuth2 Ruby Gem Authorization Header Leak via Redirect

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Client#request overrides the request authority, so the bearer Authorization header is sent to an attacker-controlled host, leaking the credential. This issue is fixed in version 2.0.22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-54603
EUVD
EUVD-2026-49903

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
ruby-oauth oauth2 From 2.0.22 (exc) to 2.0.21 (inc)
ruby-oauth oauth2 to 2.0.21 (inc)
oauth2 oauth2 From 0.4.0 (inc) to 2.0.22 (exc)
oauth2 oauth2 2.0.22

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54603 is a vulnerability in the ruby-oauth/oauth2 gem affecting versions 0.4.0 to 2.0.21. It involves protocol-relative redirect Location values in OAuth2 responses that override the request authority, causing the client to send bearer Authorization headers to attacker-controlled hosts. This leaks credentials and may enable unauthorized access.

Detection Guidance

To detect this vulnerability, inspect your Ruby applications using the oauth2 gem versions 0.4.0 to 2.0.21. Check for protocol-relative redirects in OAuth2 responses by reviewing server logs or network traffic for patterns like //attacker.example/leak. Use commands like gem list oauth2 to verify installed versions.

Impact Analysis

An attacker could exploit this to intercept OAuth2 bearer tokens, leading to unauthorized access to user accounts or sensitive data. The vulnerability allows credential leakage without requiring user interaction or privileges, making it high-risk for applications using affected versions.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding sensitive information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the oauth2 gem to version 2.0.22 or later using gem update oauth2. If updating is not possible, review and modify OAuth2 client code to strip Authorization headers during redirects and avoid protocol-relative URLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54603. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart