A high-severity vulnerability in the Ruby OAuth2 gem (versions 0.4.0 through 2.0.21) allows for open redirection and potential sensitive information exposure, risking user account security.

This flaw includes CWE-200 (Exposure of Sensitive Information) and CWE-601 (Open Redirect). The vulnerability allows an unauthenticated attacker to manipulate redirection targets and potentially intercept sensitive authorization tokens or user information during the OAuth flow.

The CVSS score of 8.6 highlights the critical impact of this vulnerability on user trust and data privacy. Successful exploitation could lead to large-scale account takeovers or the theft of sensitive authentication credentials, resulting in significant reputational damage and potential regulatory non-compliance regarding data protection.

Immediate Action: Update the oauth2 gem to version 2.0.22 or later within your Ruby application's Gemfile.

Proactive Monitoring: Monitor application logs for suspicious redirect parameters or unexpected external traffic patterns associated with the OAuth callback URL.

Compensating Controls: Implement strict allow-lists for redirect URIs within your OAuth configuration to prevent arbitrary redirection to untrusted domains.

Public Exploit Available: No (no confirmed weaponized exploit)

Given the critical nature of OAuth implementation in modern web applications, this update should be treated as urgent. Developers must audit their existing integrations to ensure that they are using the patched version of the oauth2 gem and that all redirect URI handling is strictly validated.