{"action":"Upgrade oauth2 to 2.0.22 or later.","affected":[{"fixed":"2.0.22","introduced":"0.4.0"}],"component":"oauth2","cve_ids":["CVE-2026-54603"],"ecosystem":"RubyGems","epss":0.00448,"exploited":false,"fixed_versions":["2.0.22"],"ghsa_id":"GHSA-pp92-crg2-gfv9","id":"tcs_01M5KEMNSDYK1D1SDS7DP3Y8N2","modified_at":"2026-09-10T03:50:52.871332161Z","published_at":"2026-07-28T16:32:45Z","references":["https://osv.dev/vulnerability/GHSA-pp92-crg2-gfv9","https://github.com/ruby-oauth/oauth2/security/advisories/GHSA-pp92-crg2-gfv9","https://github.com/ruby-oauth/oauth2/commit/0f0a474f1b38453e119e660c2daca742d4378ce9","https://github.com/ruby-oauth/oauth2","https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.22"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-pp92-crg2-gfv9","url":"https://osv.dev/vulnerability/GHSA-pp92-crg2-gfv9"}],"summary":"OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host"}