What is the CVSS score of EUVD-2026-49903?

EUVD-2026-49903 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for EUVD-2026-49903?

Yes, a public proof-of-concept exploit is available for EUVD-2026-49903. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for EUVD-2026-49903?

Yes, a patch is available for EUVD-2026-49903. Update the affected software to the latest version immediately.

Oauth2 EUVD-2026-49903

| CVE-2026-54603 HIGH

Information Exposure (CWE-200)

2026-07-28 GitHub_M

GHSA-pp92-crg2-gfv9

Information Disclosure Oauth2 Suse

8.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

SUSE

HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 28, 2026 - 18:02 EUVD

Source Code Evidence Fetched

Jul 28, 2026 - 17:16 vuln.today

Analysis Generated

Jul 28, 2026 - 17:16 vuln.today

CVE Published

Jul 28, 2026 - 16:29 cve.org

HIGH 8.6

DescriptionCVE.org

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Client#request overrides the request authority, so the bearer Authorization header is sent to an attacker-controlled host, leaking the credential. This issue is fixed in version 2.0.22.