Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Client#request overrides the request authority, so the bearer Authorization header is sent to an attacker-controlled host, leaking the credential. This issue is fixed in version 2.0.22.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-54603: Cross-Origin Credential Leakage and SSRF in ruby-oauth2 https://ift.tt/eClgoFm
Post summary
The text merely announces CVE‑2026‑54603 with a link, providing no substantive technical, exploit, or mitigation details.
🚨HIGH - oauth2 Ruby Gem Token Leak + SSRF via Protocol-Relative Redirect (CVE-2026-54603) In oauth2, OAuth2::Client#request follows protocol-relative Location redirects ("//host/path") and overrides the original authority. An attacker can force a redirect to an attacker-controlled host and the client resends the request with Authorization: Bearer intact, leaking tokens and enabling SSRF. 👉Affected: oauth2 0.4.0-2.0.21 | Upgrade to 2.0.22
Post summary
The advisory announces CVE-2026-54603, a token leakage and SSRF flaw in the oauth2 Ruby gem caused by protocol‑relative redirects, and recommends upgrading to version 2.0.22.