CVE-2026-54603: OAuth2 Package Vulnerability Leading to Bearer Token Leakage

Background

The OAuth2 package is a Ruby library that facilitates the implementation of OAuth 2.0 authentication flows in applications. It allows developers to easily manage access tokens and make authenticated requests to resource servers. However, a critical vulnerability has been identified in versions up to 2.0.21, where protocol-relative redirects can lead to unauthorized disclosure of bearer tokens.

Vulnerability Detail

The vulnerability arises from the handling of protocol-relative redirect URIs in the OAuth2::Client#request method. When an authorization server returns a redirect with a Location header formatted as a protocol-relative URI (e.g., //attacker.example/leak), the OAuth2 client incorrectly resolves this URI, replacing the authority of the base URL with that of the attacker. This results in the bearer token being sent to the attacker-controlled host without any additional user interaction, leading to potential credential leakage and server-side request forgery (SSRF). The vulnerability affects all versions of the OAuth2 package from 0.4.0 to 2.0.21.

gem install oauth2 -v 2.0.25

gem install oauth2 -v 2.0.22

Workaround

As a temporary workaround, you can modify the OAuth2::Client#request method to handle protocol-relative locations safely. Here’s a code snippet to implement this patch:

module OAuth2 class Client

    def request(verb, url, req_opts = {}, &block)

  response = execute_request(verb, url, req_opts, &block)
  status = response.status
  case status
  when 301, 302, 303, 307
    req_opts[:redirect_count] ||= 0
    req_opts[:redirect_count] += 1

        return response if req_opts[:redirect_count] > options[:max_redirects]

    verb = :get and req_opts.delete(:body) if status == 303
    location = response.headers["location"]
    if location
      safe_location = location.start_with?("//") ? "./#{location}" : location
      full_location = response.response.env.url.merge(safe_location)
      request(verb, full_location, req_opts)
    else
      raise(Error.new(response), "Got #{status} status code, but no Location header was present")
    end
  end
end

end end

Conclusion

The CVE-2026-54603 vulnerability in the OAuth2 package poses a significant risk of bearer token leakage through improper handling of protocol-relative redirects. It is crucial to update to version 2.0.22 or later to safeguard your application. Additionally, utilizing the Vulert platform can help monitor and alert for such vulnerabilities in real-time.

See every vulnerability recorded for oauth2 →

FAQ