CyberRota Analysis
AI-GeneratedA vulnerability in the OAuth2 Ruby wrapper allows an attacker to exploit protocol-relative redirects, leading to the leakage of bearer authorization headers to a malicious host. This can result in unauthorized access to sensitive credentials, posing a significant risk to applications using affected versions (0.4.0 to 2.0.21). Developers and security teams using this library should prioritize upgrading to version 2.0.22 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Client#request overrides the request authority, so the bearer Authorization header is sent to an attacker-controlled host, leaking the credential. This issue is fixed in version 2.0.22.