OmniAuth CVE-2026-63183

Exploitable only when all of these hold: the application uses OmniAuth prior to 2.2.0; it has NOT set a fixed full_host (or, after the fix, allowed_hosts) in its OmniAuth config; and the surrounding web framework does not validate incoming Host headers. OmniAuth derives the callback host from the client-controllable Host, X-Forwarded-Host, or Forwarded header, so a remote unauthenticated attacker can forge it. Limiting factors that reduce real-world exposure: applications on modern Rails with config.hosts host authorization configured, or any app with a fixed full_host, are explicitly not affected; impact is a forged provider redirect_uri rather than direct code execution, and realizing a meaningful redirect/code-theft outcome depends on the OAuth provider and typically a victim completing the flow. The mitigation stated by the vendor is to set full_host (or the new allowed_hosts) and to upgrade to 2.2.0.

This is a genuine but moderate, configuration-dependent weakness (CWE-346 origin/host validation) rather than a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 (medium) with only low vulnerable- and subsequent-system integrity/confidentiality impact (VC:L/VI:L/SI:L, VA/SA/SC none), which matches a host-header-injection flaw whose worst outcome is a forged provider redirect_uri rather than code execution or full account takeover. The vuln.today priority is 'this_month', not act_now/emergency, and the input contains no EPSS score and no KEV listing, so there is no signal of active or widespread exploitation. The PoC situation is limited to the GitHub Security Advisory and the fix commit - a public PoC reference exists; it is not verified as working exploit code - so exploitation is best described as no public exploit identified at time of analysis. The key caveat that must not be read as confirmed fact: the flaw only applies 'when neither a fixed full_host nor framework-level incoming host validation is configured,' so real-world risk hinges entirely on deployment configuration, and applications using Rails host authorization (config.hosts) or a fixed full_host are explicitly not affected. EPSS and KEV data are both absent from the input, which should be treated as missing signals, not as evidence of safety.

An application uses OmniAuth behind a web framework that does not validate incoming Host headers and has not set full_host or allowed_hosts. During the OAuth request phase a remote unauthenticated attacker supplies a forged Host (or X-Forwarded-Host / Forwarded) header, causing OmniAuth to build a callback redirect_uri pointing at an attacker-controlled host, which can be used to send the provider a redirect on someone else's site. No confirmed working exploit code is published - only the advisory and fix commit are referenced - and the CVSS vector indicates a network, low-complexity, no-privilege path.