UBUNTU-CVE-2026-63183: Medium severity ubuntu/ruby-omniauth vulnerability

Published Nov 5, 2026

Updated

OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed fullhost nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, creating a host header injection risk in applications whose web framework does not verify incoming host headers. Applications using appropriately configured Rails host authorization or a fixed fullhost are not affected by this path. This issue is fixed in version 2.2.0.

Affected Software

7 affected components

ubuntu/ruby-omniauth*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OmniAuth to a version that resolves this vulnerability.
Fixed in 2.2.0
Configuration
Configure a fixed full_host so provider callback URLs do not derive the host from request-controlled information.
OmniAuth full_host = fixed

Event History

Nov 5, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using OmniAuth before 2.2.0 are exposed if they neither set a fixed full_host nor use framework-level validation of incoming Host headers. Applications with appropriately configured Rails host authorization or a fixed full_host are not affected by this path.

What does an attacker need to exploit it?

A remote, unauthenticated client must be able to send a request with a forged Host header to an application whose framework does not validate incoming host headers. No user interaction or prior privileges are required.

What can be done before upgrading?

Configure OmniAuth with a fixed full_host, or enable and appropriately configure incoming Host header validation in the application framework. These controls prevent callback URLs from being derived from attacker-controlled host information.

How can I determine whether my application is affected?

Check whether the deployed OmniAuth version is earlier than 2.2.0, then review whether full_host is fixed and whether the framework validates incoming Host headers. The vulnerable path requires both controls to be absent or not appropriately configured.

UBUNTU-CVE-2026-63183: Medium severity ubuntu/ruby-omniauth vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What can be done before upgrading?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What can be done before upgrading?

How can I determine whether my application is affected?