OAuth2::Client#request has a flaw where a protocol-relative redirect Location can override the request authority, causing the bearer Authorization header to be sent to an attacker-controlled host. This leak exposes the OAuth bearer token, allowing an attacker to impersonate the user and access protected resources. The weakness involves improper input handling and open redirect behavior, aligning with CWE-200 and CWE-601.

The vulnerability affects the ruby-oauth OAuth2 gem in all releases from 0.4.0 through 2.0.21. Users deploying any of these versions should verify their gem version and consider an upgrade.

With a CVSS score of 8.6 the vulnerability is considered high severity, yet the EPSS score of < 1% indicates the likelihood of exploitation is very low at the present moment. It is not listed in CISA's KEV catalog. The attack would require an application to issue a redirect response that the attacker can control or influence, targeting the redirected host that receives the leaked Authorization header.