CVE-2026-63183

Name of the Vulnerable Software and Affected Versions OmniAuth versions prior to 2.2.0

Description OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full host nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, leading to a host header injection risk in applications where the web framework does not verify incoming host headers.

Recommendations Update to version 2.2.0. Configure a fixed full host. Implement framework-level incoming host validation, such as Rails host authorization.