CVE-2026-54605 Details
Description
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6.
A vulnerability exists in the OAuth library for Ruby, specifically in versions 0.5.5 prior to 1.1.5. The issue arises in the `OAuth::Consumer#token_request` method, which handles redirects from the OAuth server. In the affected versions, the method follows redirects from 300 to 399, potentially leading to cross-origin requests that expose sensitive OAuth metadata, including the Authorization header, to an external host. This behavior can also be exploited as a Server-Side Request Forgery (SSRF) or confused-deputy attack, where the application server is tricked into making requests on behalf of an attacker.
Users can update to OAuth version 1.1.6, which addresses the vulnerability by rejecting cross-origin token endpoint redirects by default and requiring explicit opt-in for integrations that depend on that behavior.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-346 | Origin Validation Error | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |