OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host

{
                    "vendor": "ruby-oauth",
                    "product": "oauth2",
                    "versions": [
                        {
                            "version": ">= 0.4.0, < 2.0.22",
                            "status": "affected"
                        }
                    ]
                }