CVE-2026-54605: OAuth: Cross-origin token-request redirects can expose signed request metadata

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-28 · updated 2026-10-23
Weakness: CWE-200

Description

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6.

Affected products

ruby-oauth oauth: from 0.5.5, < 1.1.6

References

https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f
https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6
https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh
https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh

Get alerted when CVE-2026-54605 or the next vulnerability affects your stack