CVE-2026-54605

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f
https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6
https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh
https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) OAuth es un wrapper de Ruby para los protocolos OAuth 1.0 y 1.0a, que proporciona clientes y servidores. Desde 0.5.5 hasta 1.1.5, OAuth::Consumer#token_request analiza el encabezado Location sin procesar de una redirección 300 a 399 devuelta por el servidor OAuth y sigue la redirección de forma recursiva, lo que puede mutar la configuración del consumidor y exponer metadatos de solicitud OAuth firmados, incluyendo el encabezado de autorización, a un host de origen cruzado. Este problema se ha solucionado en la versión 1.1.6.

Information

Published : 2026-07-28 17:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-54605

Mitre link : CVE-2026-54605

CVE.ORG link : CVE-2026-54605

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-346

Origin Validation Error

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-54605", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54605", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T17:37:16.671700Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ruby-oauth", "product": "oauth", "versions": [{"status": "affected", "version": ">= 0.5.5, < 1.1.6"}]}]}], "published": "2026-07-28T17:16:52.367", "references": [{"url": "https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f", "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh", "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6."}, {"lang": "es", "value": "OAuth es un wrapper de Ruby para los protocolos OAuth 1.0 y 1.0a, que proporciona clientes y servidores. Desde 0.5.5 hasta 1.1.5, OAuth::Consumer#token_request analiza el encabezado Location sin procesar de una redirecci\u00f3n 300 a 399 devuelta por el servidor OAuth y sigue la redirecci\u00f3n de forma recursiva, lo que puede mutar la configuraci\u00f3n del consumidor y exponer metadatos de solicitud OAuth firmados, incluyendo el encabezado de autorizaci\u00f3n, a un host de origen cruzado. Este problema se ha solucionado en la versi\u00f3n 1.1.6."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "security-advisories@github.com"}