High, CVSS 8.6RubyGemsAmendedPublished
OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host
CVE-2026-54603 · GHSA-pp92-crg2-gfv9
- Affected
- RubyGems oauth2 >= 0.4.0, <= 2.0.21
- Fixed in
- 2.0.22· Vendor fix available
- Issue
- When an application uses OAuth2::Client (typically via an OAuth2::AccessToken) and the configured authorization server returns a redirect whose Location header is a protocol-relative URI of the form //attacker.example/leak, OAuth2::Client#request resolves the redirect with response.response.env.url.merge(location). Per RFC 3986 §5.2, an input that starts with // is a network-path reference and replaces the authority of the base URL: URI("http://idp.trusted/userinfo").merge("//attacker.example/leak") returns http://attacker.example/leak. The recursive request(verb, fulllocation, reqopts) call then re-sends the request to the attacker host while preserving the Authorization: Bearer <access-token header that OAuth2::AccessToken#configureauthentication! installed on reqopts[:headers] for the original request. The result is a one-shot cross-origin credential disclosure: any 30x response from the IdP that an attacker can influence (a compromised endpoint, a tenant-controlled IdP in…
Recommended action: Upgrade to 2.0.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.