CVE-2026-54603 OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host
Attackers can leak bearer tokens to malicious hosts via protocol-relative redirects in the Ruby OAuth2 library, compromising user credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54603?
CVE-2026-54603 is a high-severity vulnerability in ruby-oauth oauth2, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Client#request overrides the request authority, so the bearer Authorization header is sent to an attacker-controlled host, leaking the credential. This issue is fixed in version 2.0.22.
Which versions are affected by CVE-2026-54603?
2 open source packages ship an affected version, including oauth2.
| Package | Affected | Fixed in |
|---|---|---|
oauth2 RubyGems | From 0.4.0 | 2.0.22 |
oauth2 RubyGems | From 0.4.0 | 2.0.22 |
How do I fix CVE-2026-54603?
Upgrade oauth2 to 2.0.22 or later.
Is CVE-2026-54603 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54603 exists.
Sources
Also known as DEBIAN-CVE-2026-54603, GHSA-pp92-crg2-gfv9, UBUNTU-CVE-2026-54603.