CVE-2026-63183

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63183", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-15T22:13:00.721Z", "datePublished": "2026-11-04T19:07:04.712Z", "dateUpdated": "2026-11-05T19:20:06.749Z"}, "containers": {"cna": {"title": "OmniAuth: Host Header Injection Vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/omniauth/omniauth/security/advisories/GHSA-m27g-v28p-f9fx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/omniauth/omniauth/security/advisories/GHSA-m27g-v28p-f9fx"}, {"name": "https://github.com/omniauth/omniauth/commit/943b44faea242f063fa9230254fe7d60cfcc9c90", "tags": ["x_refsource_MISC"], "url": "https://github.com/omniauth/omniauth/commit/943b44faea242f063fa9230254fe7d60cfcc9c90"}], "affected": [{"vendor": "omniauth", "product": "omniauth", "versions": [{"version": "< 2.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T19:07:04.712Z"}, "descriptions": [{"lang": "en", "value": "OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, creating a host header injection risk in applications whose web framework does not verify incoming host headers. Applications using appropriately configured Rails host authorization or a fixed full_host are not affected by this path. This issue is fixed in version 2.2.0."}], "source": {"advisory": "GHSA-m27g-v28p-f9fx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T19:19:56.610534Z", "id": "CVE-2026-63183", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:20:06.749Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63183", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T19:19:56.610534Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:20:02.371Z"}}], "cna": {"title": "OmniAuth: Host Header Injection Vulnerability", "source": {"advisory": "GHSA-m27g-v28p-f9fx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "omniauth", "product": "omniauth", "versions": [{"status": "affected", "version": "< 2.2.0"}]}], "references": [{"url": "https://github.com/omniauth/omniauth/security/advisories/GHSA-m27g-v28p-f9fx", "name": "https://github.com/omniauth/omniauth/security/advisories/GHSA-m27g-v28p-f9fx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/omniauth/omniauth/commit/943b44faea242f063fa9230254fe7d60cfcc9c90", "name": "https://github.com/omniauth/omniauth/commit/943b44faea242f063fa9230254fe7d60cfcc9c90", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, creating a host header injection risk in applications whose web framework does not verify incoming host headers. Applications using appropriately configured Rails host authorization or a fixed full_host are not affected by this path. This issue is fixed in version 2.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T19:07:04.712Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63183", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:20:06.749Z", "dateReserved": "2026-07-15T22:13:00.721Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-04T19:07:04.712Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "omniauth", "vendor": "omniauth", "versions": [{"status": "affected", "version": "< 2.2.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, creating a host header injection risk in applications whose web framework does not verify incoming host headers. Applications using appropriately configured Rails host authorization or a fixed full_host are not affected by this path. This issue is fixed in version 2.2.0."}], "id": "CVE-2026-63183", "lastModified": "2026-11-12T20:04:52.377", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63183", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T19:19:56.610534Z", "version": "2.0.3"}}]}, "published": "2026-11-04T19:17:40.650", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/omniauth/omniauth/commit/943b44faea242f063fa9230254fe7d60cfcc9c90"}, {"source": "security-advisories@github.com", "url": "https://github.com/omniauth/omniauth/security/advisories/GHSA-m27g-v28p-f9fx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "omniauth: OmniAuth: Host header injection via forged HTTP Host header", "id": "2567543", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567543"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-346", "details": ["OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, creating a host header injection risk in applications whose web framework does not verify incoming host headers. Applications using appropriately configured Rails host authorization or a fixed full_host are not affected by this path. This issue is fixed in version 2.2.0.", "A flaw was found in OmniAuth. When host validation is not configured, OmniAuth derives authentication callback URLs from untrusted request headers. A remote, unauthenticated attacker can exploit this vulnerability by sending a forged HTTP (Hypertext Transfer Protocol) Host header. This can allow an attacker to manipulate callback destinations, potentially redirecting authentication flows to an attacker-controlled server and leading to credential disclosure."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, configure explicit host validation in the application or enforce host filtering at the reverse proxy layer:\n1. Configure a static host in OmniAuth by setting the `full_host` option in the application configuration (for example, in `config/initializers/omniauth.rb`):\n```ruby\nOmniAuth.config.full_host = 'https://your-domain.example.com'\n```\n2. Alternatively, enable host authorization at the application framework level (such as Rails `config.hosts` in `config/environments/production.rb`) or configure the front-end reverse proxy to validate and reject untrusted HTTP Host headers.\nCaveats:\nSetting a static `full_host` forces all authentication callbacks to use the designated URL, which may impact multi-tenant environments relying on dynamic hostnames. Modifying application configurations or reverse proxy settings requires restarting or reloading the affected web services."}, "name": "CVE-2026-63183", "public_date": "2026-11-04T19:07:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63183\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63183\nhttps://github.com/omniauth/omniauth/commit/943b44faea242f063fa9230254fe7d60cfcc9c90\nhttps://github.com/omniauth/omniauth/security/advisories/GHSA-m27g-v28p-f9fx"], "statement": "This vulnerability is rated as Moderate impact because successful exploitation requires specific environmental prerequisites, namely that the hosting application and reverse proxy do not restrict or validate incoming HTTP host headers. In standard production deployments, modern web frameworks and edge proxies typically enforce strict host authorization, preventing external clients from tampering with redirection endpoints. Consequently, the flaw only poses a risk in setups lacking these default architectural controls, limiting its potential blast radius across Red Hat environments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "omniauth", "source": "cna", "vendor": "omniauth"}, "product": "omniauth", "vendor": "omniauth"}], "created": "2026-11-04T20:45:07.038743+00:00", "updated": "2026-11-04T20:45:07.232530+00:00", "vendors": ["omniauth", "omniauth$PRODUCT$omniauth"]}