CVE-2026-54603: Cross-Origin Credential Leakage and SSRF via Protocol-Relative Redirects in ruby-oauth2
Vulnerability ID: CVE-2026-54603
CVSS Score: 8.6
Published: 2026-07-28
An issue in the ruby-oauth2 gem allows unauthenticated attackers to steal OAuth access tokens or perform Server-Side Request Forgery (SSRF) via a protocol-relative URI in HTTP Location redirect headers.
TL;DR
The oauth2 Ruby gem leaks active Authorization bearer tokens to untrusted external hosts when following protocol-relative redirects (starting with //) and enables server-side request forgery.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-200, CWE-601
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 8.6 (High)
- EPSS Score: Not Available
- Impact: High (Credential Disclosure / SSRF)
- Exploit Status: Proof-of-Concept
- KEV Status: Not Listed
Affected Systems
- Ruby applications using the oauth2 gem for OAuth authentication workflows
-
oauth2: >= 0.4.0, <= 2.0.21 (Fixed in:
2.0.22)
Code Analysis
Commit: 0f0a474
Resolve protocol-relative redirection vulnerability in Client#request
Mitigation Strategies
- Upgrade the oauth2 gem to version 2.0.22 or higher
- Implement client-side header scrubbing during HTTP redirects within application code
- Deploy network-level egress restrictions to block outbound application requests to arbitrary target IP addresses
Remediation Steps:
- Open your application's Gemfile and locate the oauth2 dependency entry
- Modify the dependency constraint to require version >= 2.0.22
- Execute 'bundle update oauth2' to pull and install the patched library release
- Run your test suite to ensure OAuth identity provider connections remain stable under the sanitized context
References
Read the full report for CVE-2026-54603 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)