CVE-2026-54605

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f
https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6
https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh
https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh

Configurations

No configuration.

History

28 Jul 2026, 18:17

Type	Values Removed	Values Added
References	~~() https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh -~~	() https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh -

28 Jul 2026, 17:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-28 17:16

Updated : 2026-07-28 18:17

NVD link : CVE-2026-54605

Mitre link : CVE-2026-54605

CVE.ORG link : CVE-2026-54605

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-346

Origin Validation Error

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-54605", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54605", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T17:37:16.671700Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ruby-oauth", "product": "oauth", "versions": [{"status": "affected", "version": ">= 0.5.5, < 1.1.6"}]}]}], "published": "2026-07-28T17:16:52.367", "references": [{"url": "https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f", "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh", "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6."}], "lastModified": "2026-07-28T18:17:22.090", "sourceIdentifier": "security-advisories@github.com"}