CVE-2026-54603

RubyGems/oauth2 CVE-2026-54603: high 8.6, EPSS 0.45%

OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host

Action: Upgrade oauth2 to 2.0.22 or later.

bundle update oauth2

Affected

Fixed versions

Sources

• osv: GHSA-pp92-crg2-gfv9
• https://github.com/ruby-oauth/oauth2/security/advisories/GHSA-pp92-crg2-gfv9
• https://github.com/ruby-oauth/oauth2/commit/0f0a474f1b38453e119e660c2daca742d4378ce9
• https://github.com/ruby-oauth/oauth2
• https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.22

CVE-2026-54603 · published 2026-07-28T16:32:45Z · modified 2026-09-10T03:50:52.871332161Z · JSON