OmniAuth - Host Header Injection Vulnerability
Published: October 22, 2026
SECURITY IDENTIFIERS
- CVE: CVE-2026-63183 (NVD)
- GHSA: GHSA-m27g-v28p-f9fx
GEM
PATCHED VERSIONS
>= 2.2.0
DESCRIPTION
Host header injection risk when using Omniauth with a web framework that does not verify incoming host headers. An example of a framework that provides host header validation is modern Rails when configured appropriately
RELATED
- https://nvd.nist.gov/vuln/detail/CVE-2026-63183
- https://rubygems.org/gems/omniauth/versions/2.2.0
- https://github.com/omniauth/omniauth/releases/tag/v2.2.0
- https://github.com/omniauth/omniauth/blob/master/CHANGELOG.md#220---2026-10-22
- https://github.com/omniauth/omniauth/commit/943b44faea242f063fa9230254fe7d60cfcc9c90
- https://advisories.gitlab.com/gem/omniauth/CVE-2026-63183
- https://osv.dev/vulnerability/GHSA-m27g-v28p-f9fx
- https://github.com/omniauth/omniauth/security/advisories/GHSA-m27g-v28p-f9fx
- https://github.com/advisories/GHSA-m27g-v28p-f9fx