{"affected":[{"product":"omniauth","source":"CNA: GitHub_M","vendor":"omniauth","versions":[{"status":"affected","version":"< 2.2.0"}]}],"cveId":"CVE-2026-63183","cwes":["CWE-346"],"description":"OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, creating a host header injection risk in applications whose web framework does not verify incoming host headers. Applications using appropriately configured Rails host authorization or a fixed full_host are not affected by this path. This issue is fixed in version 2.2.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N","version":"4.0"}],"modifiedAt":1793819224712,"publishedAt":1793819224712,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/omniauth/omniauth/security/advisories/GHSA-m27g-v28p-f9fx"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/omniauth/omniauth/commit/943b44faea242f063fa9230254fe7d60cfcc9c90"}],"remediation":[],"revision":"9e6918e7e4075db358c54eec82fe9067b5c799d0aaa135726f7107361ebed21f","sources":[{"modifiedAt":1793819224712,"name":"CNA: GitHub_M","retrievedAt":1793822973817,"url":"https://www.cve.org/CVERecord?id=CVE-2026-63183"}],"ssvc":null,"status":"published","title":"OmniAuth: Host Header Injection Vulnerability","updatedAt":1793822973817}