OmniAuth: Host Header Injection Vulnerability

Impact

Host header injection risk when using Omniauth with a web framework that does not verify incoming host headers. An example of a framework that provides host header validation is modern Rails when configured appropriately

Patches

2.2.0

Workarounds

Set the full_host config in the Omniauth config