HIGH 8.6 GitHub
CVE-2026-54603
OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host
## Summary
When an application uses `OAuth2::Client` (typically via an `OAuth2::AccessToken`) and the configured authorization server returns a redirect whose `Location` header is a protocol-relative URI of the form `//attacker.example/leak`, `OAuth2::Client#request` resolves the redirect with `response.response.env.url.merge(location)`. Per RFC 3986 §5.2, an input that starts with `//` is a network-path reference and replaces the authority of the base URL: `URI("http://idp.trusted/userinfo").m
Affected Products
- rubygems/oauth2 >= 0.4.0, <= 2.0.21
References
- https://github.com/advisories/GHSA-pp92-crg2-gfv9
- https://github.com/ruby-oauth/oauth2/security/advisories/GHSA-pp92-crg2-gfv9
- https://github.com/ruby-oauth/oauth2/commit/0f0a474f1b38453e119e660c2daca742d4378ce9
- https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.22
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-07-28 via GitHub. Affected: rubygems/oauth2 >= 0.4.0, <= 2.0.21.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.