Skip to content
Heist/ feed
High

OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host

Type: advisorySource: Official CVE List1 source record

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Client#request overrides the request authority, so the bearer Authorization header is sent to an attacker-controlled host, leaking the credential. This issue is fixed in version 2.0.22.

Announced Source revision 1
Original source ↗

CVE-2026-54603

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-54603

oauth2

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "ruby-oauth",
    "product": "oauth2",
    "versions": [
      {
        "status": "affected",
        "version": ">= 0.4.0, < 2.0.22"
      }
    ]
  }
]
Related CVEs
CVE-2026-54603

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#8809 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement