OAuth Vulnerability in Ruby Wrapper for OAuth Protocols Affects OAuth Clients
CVE-2026-54605

7.2HIGH

Key Information:

Vendor

Ruby-oauth

Status
Oauth
Vendor
CVE Published:
28 July 2026

What is CVE-2026-54605?

A vulnerability has been identified in the OAuth Ruby wrapper, specifically from versions 0.5.5 to 1.1.5. The OAuth::Consumer#token_request method improperly parses the raw Location header of redirects (300 to 399) returned by the OAuth server. This mismanagement can lead to the recursive following of redirects, potentially mutating the consumer's configuration. Consequently, this exposes signed OAuth request metadata, including sensitive information like the Authorization header, to unintended cross-origin hosts. Users must upgrade to version 1.1.6 to mitigate this security risk.

Affected Version(s)

oauth >= 0.5.5, < 1.1.6

References

https://github.com/ruby-oauth/oauth/security/advisories/G...
x_refsource_CONFIRM
https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631...
x_refsource_MISC
https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.