Threats tagged 'ghsa-m27g-v28p-f9fx'

CVE-2026-63183 is a host header injection vulnerability in OmniAuth versions prior to 2.2.0. The issue arises when OmniAuth is used with web frameworks that do not validate incoming host headers, potentially allowing an attacker to manipulate host headers. Modern Rails frameworks can mitigate this risk if configured properly. A fix is available in OmniAuth version 2.2.0, and setting the `full_host` configuration in OmniAuth serves as a workaround.