High severity · published Jul 28, 2026
CVE-2026-54605
OAuth: Cross-origin token-request redirects can expose signed request metadata
7.2
CVSS
0.2%
EPSS
No
On KEV
Description
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
oauth · ruby-oauth
>= 0.5.5, < 1.1.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54605
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54605
github.com
https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f
github.com
https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6
github.com
https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh