CVE-2026-63183
OmniAuth: Host Header Injection Vulnerability
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, creating a host header injection risk in applications whose web framework does not verify incoming host headers. Applications using appropriately configured Rails host authorization or a fixed full_host are not affected by this path. This issue is fixed in version 2.2.0.
| CWE | CWE-346 |
| Vendor | omniauth |
| Product | omniauth |
| Published | Nov 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for omniauth omniauth
Be the first to know when new unknown vulnerabilities affecting omniauth omniauth are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
omniauth / omniauth
< 2.2.0