CVE-2026-54605
OAuth: Cross-origin token-request redirects can expose signed request metadata
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6.
| CWE | CWE-200 CWE-346 CWE-918 |
| Vendor | ruby-oauth |
| Product | oauth |
| Published | Jul 28, 2026 |
| Last Updated | Jul 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for ruby-oauth oauth
Be the first to know when new high vulnerabilities affecting ruby-oauth oauth are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
ruby-oauth / oauth
>= 0.5.5, < 1.1.6