OmniAuth versions before 2.2.0 build provider callback URLs from request-host data when no fixed full_host or framework-level host validation exists. This allows a remote unauthenticated client to send a forged Host header, resulting in host header injection that can manipulate callback URLs and potentially redirect users or bypass access controls. The CWE categorizes this as Non-Validated Input Leading to Host Header Injection.

The vulnerable component is the OmniAuth library. Versions earlier than 2.2.0 of the omniauth:omniauth package are affected. Applications that do not have Rails host authorization enabled or do not set a fixed full_host are vulnerable.

The CVSS score of 6.9 indicates a medium severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting limited documented exploitation. However, the attack vector is remote, unauthenticated, and relies on delivering a forged Host header over HTTP or HTTPS. If the surrounding web framework does not verify incoming host headers, an attacker can exploit this issue to alter callback URLs or induce denial of service.