Vulnerability · Published Jul 28, 2026 · Assigned by GitHub_M

CVE-2026-54605OAuth: Cross-origin token-request redirects can expose signed request metadata

High 7.2

In plain English

A high-severity information exposure in oauth from ruby-oauth. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.2%top 91.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
RubyGems	oauth	1.1.6	GHSA-prq8-7wvh-44qh
Ubuntu:22.04:LTS	ruby-oauth	no fix listed	UBUNTU-CVE-2026-54605
Ubuntu:24.04:LTS	ruby-oauth	no fix listed	UBUNTU-CVE-2026-54605
Ubuntu:26.04:LTS	ruby-oauth	no fix listed	UBUNTU-CVE-2026-54605
Ubuntu:26.10	ruby-oauth	no fix listed	UBUNTU-CVE-2026-54605

Affected products (as reported)

Vendor	Product	Versions
ruby-oauth	oauth	>= 0.5.5, < 1.1.6

Weakness: CWE-200, CWE-346, CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh x_refsource_CONFIRM
https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f x_refsource_MISC
https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6 x_refsource_MISC