{"id":"CVE-2026-63183","aliases":["GHSA-m27g-v28p-f9fx"],"url":"https://o3.security/vulnerability/CVE-2026-63183","summary":"OmniAuth: Host Header Injection Vulnerability","details":"OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, creating a host header injection risk in applications whose web framework does not verify incoming host headers. Applications using appropriately configured Rails host authorization or a fixed full_host are not affected by this path. This issue is fixed in version 2.2.0.","published":"2026-11-04T19:07:04.712Z","modified":"2026-11-07T02:30:32.112567271Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"RubyGems","name":"omniauth","fixedVersion":"2.2.0"}],"fix":{"url":"https://github.com/omniauth/omniauth/commit/943b44faea242f063fa9230254fe7d60cfcc9c90","label":"omniauth/omniauth@943b44f"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63183.json"},{"type":"ADVISORY","url":"https://github.com/omniauth/omniauth/security/advisories/GHSA-m27g-v28p-f9fx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63183"},{"type":"FIX","url":"https://github.com/omniauth/omniauth/commit/943b44faea242f063fa9230254fe7d60cfcc9c90"},{"type":"PACKAGE","url":"https://github.com/omniauth/omniauth"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-07T02:30:32.112567271Z"}}