CVE-2026-63183: OmniAuth: Host Header Injection Vulnerability
OmniAuth is a flexible authentication system utilizing Rack middleware ...
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OmniAuthto a version that resolves this vulnerability.Fixed in 2.2.0 - Configuration
Configure Rails host authorization to validate incoming Host headers.
Rails host authorization = appropriately configured - Configuration
Set a fixed full_host value so provider callback URLs do not use request-controlled host information.
OmniAuth full_host = fixed
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using OmniAuth before 2.2.0 are exposed when they neither configure a fixed full_host nor use framework-level validation of incoming Host headers. Applications with appropriately configured Rails host authorization or a fixed full_host are not affected by this path.
What does an attacker need to exploit it?
An unauthenticated remote client needs to be able to send a request with a forged Host header to an affected application. Exploitation depends on the application framework not verifying incoming host headers.
What can be done if upgrading is not immediately possible?
Configure OmniAuth with a fixed full_host, or enable and correctly configure the web framework's incoming Host header validation. For Rails applications, appropriately configured host authorization prevents the affected path.
How can we determine whether our application is affected?
Check whether the application uses OmniAuth prior to 2.2.0 and whether callback URLs are derived without a fixed full_host. Also verify that framework-level Host header validation, such as Rails host authorization, is enabled and appropriately configured.