Fluid Attacks Database

Description

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Client#request overrides the request authority, so the bearer Authorization header is sent to an attacker-controlled host, leaking the credential. This issue is fixed in version 2.0.22.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	ruby-oauth2	=2.0.17-1 \|\| =2.0.18-1 \|\| =2.0.9-1 \|\| >=0 <2.0.25-1	2.0.25-1
rubygems	oauth2	>=0.4.0 <2.0.22	2.0.22
debian 13	ruby-oauth2	=2.0.17-1 \|\| =2.0.18-1 \|\| =2.0.25-1 \|\| =2.0.9-1	-
debian 12	ruby-oauth2	=1.4.4-1 \|\| =2.0.17-1 \|\| =2.0.18-1 \|\| =2.0.25-1 \|\| =2.0.7-1 \|\| =2.0.7-2 \|\| =2.0.9-1	-
debian 11	ruby-oauth2	=1.4.4-1 \|\| =2.0.17-1 \|\| =2.0.18-1 \|\| =2.0.25-1 \|\| =2.0.7-1 \|\| =2.0.7-2 \|\| =2.0.9-1	-

Aliases

1. CVE-2026-546032. NVD-2026-546033. OSV-DEBIAN-2026-546034. OSV-2026-546035. GHSA-pp92-crg2-gfv96. GCVE-2026-546037. SECURITY-TRACKER-CVE-2026-54603

References

1. https://github.com/ruby-oauth/oauth2/security/advisories/GHSA-pp92-crg2-gfv92. https://github.com/ruby-oauth/oauth2/commit/0f0a474f1b38453e119e660c2daca742d4378ce93. https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.22

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.