CVE-2026-54603

Name of the Vulnerable Software and Affected Versions oauth2 versions 0.4.0 through 2.0.21

Description A protocol-relative redirect in the Location header returned to OAuth2::Client#request can override the request authority. This occurs because the method resolves redirects using URI#merge, which treats inputs starting with // as network-path references that replace the base URL authority. Consequently, the Authorization: Bearer header is sent to an attacker-controlled host, leading to cross-origin credential disclosure. Additionally, this can be used to perform Server-Side Request Forgery (SSRF) by forcing the application server to make requests to internal addresses. The issue is triggered when an attacker can influence the redirect target, such as through an open redirect on the Identity Provider (IdP), a malicious tenant-controlled IdP, or a compromised network proxy.

Recommendations Update oauth2 to version 2.0.22. As a temporary mitigation, ensure that the Location header is validated or neutralized by prepending ./ to values starting with // before they are processed by URI#merge in the OAuth2::Client#request function.