CVE-2026-63183: 
Ruby Análise e mitigação de vulnerabilidades

CVE-2026-63183 is a Host Header Injection vulnerability in the OmniAuth Ruby authentication library. It affects all versions up to and including 2.1.4, with no patched version currently available. The vulnerability arises when OmniAuth is used with a web framework that does not validate incoming HTTP Host headers. It has been assigned a Low severity rating by the advisory publisher (GitHub Advisory).

The root cause is OmniAuth's reliance on the HTTP Host header without independently verifying its integrity, making it susceptible to Host Header Injection (related to CWE-20, Improper Input Validation). When deployed behind a web framework that does not enforce host header validation — unlike modern Rails with appropriate configuration — an attacker can supply a crafted Host header in HTTP requests. This can cause OmniAuth to generate URLs or redirects based on attacker-controlled input, potentially enabling phishing, password reset poisoning, or cache poisoning attacks (GitHub Advisory, PortSwigger).

Successful exploitation can allow an attacker to manipulate server-generated URLs used in authentication flows, potentially redirecting users to attacker-controlled domains. This could facilitate phishing campaigns, account takeover via poisoned password reset links, or cache poisoning depending on the application's use of OmniAuth-generated URLs. The impact is limited to scenarios where the underlying web framework does not perform host header validation (GitHub Advisory).

No public proof-of-concept exploit code, active in-the-wild exploitation, or threat actor attribution has been reported for this CVE. The vulnerability has a Low severity rating and requires a specific deployment configuration (a framework lacking host header validation) to be exploitable. It is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score data is available at this time (GitHub Advisory).

1. Reconnaissance: Identify a web application using OmniAuth (versions ≤ 2.1.4) deployed on a framework that does not validate the HTTP Host header (e.g., a non-Rails framework or misconfigured Rails).
2. Craft malicious request: Send an HTTP request to the target application's OmniAuth endpoint (e.g., /auth/<provider>) with a forged Host header pointing to an attacker-controlled domain.
3. Trigger URL generation: OmniAuth uses the Host header to construct callback or redirect URLs during the OAuth flow, incorporating the attacker-supplied host value.
4. Deliver poisoned link: The application generates and may send (e.g., via email or redirect) a URL containing the attacker's domain, which can be used to intercept authentication tokens, conduct phishing, or poison caches (GitHub Advisory, PortSwigger).

• Network: HTTP requests to OmniAuth endpoints (e.g., /auth/<provider>) containing a Host header value that does not match the application's legitimate domain.
• Logs: Web server or application logs showing requests with unexpected or external Host header values directed at authentication routes.
• Application Behavior: Outbound emails or redirects containing URLs with unexpected or external domain names generated during the OmniAuth authentication flow.

No patched version of OmniAuth is currently available for this vulnerability. The recommended workaround is to explicitly set the full_host configuration option in your OmniAuth initializer to a hardcoded, trusted value, preventing OmniAuth from relying on the incoming Host header. Additionally, deploying OmniAuth with a framework that enforces host header validation (such as modern Rails with appropriate configuration) mitigates the risk (GitHub Advisory).

The advisory was published by sferik on the OmniAuth GitHub repository on October 22, 2026, with a Low severity designation. No significant broader media coverage, researcher commentary, or community discussion has been identified at this time (GitHub Advisory).