CVE-2026-54605
Received Received - Intake

OAuth Ruby Gem Redirect Header Exposure

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-54605
EUVD
EUVD-2026-49901

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ruby-oauth oauth From 0.5.5 (exc) to 1.1.5 (inc)
oauth oauth to 1.1.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the ruby-oauth gem versions 0.5.5 to 1.1.5. When making OAuth token requests, the library follows redirects from the OAuth server. If a redirect points to a different host with the same path, it mutates the consumer's configuration and signs requests for the attacker-controlled host. This exposes sensitive OAuth parameters like consumer keys and signatures to unauthorized origins.

Detection Guidance

To detect this vulnerability, check if your system uses ruby-oauth gem versions between 0.5.5 and 1.1.5. Run: gem list oauth. If installed, verify version with: gem list oauth | grep -E '0\.(5\.[5-9]|[6-9]|1\.[01]\.[0-5])'. Inspect OAuth::Consumer#token_request usage in code for redirect handling logic.

Impact Analysis

An attacker could exploit this to intercept sensitive OAuth metadata, perform server-side request forgery from your network, or trick your application into making signed requests to unintended hosts. The attack requires no privileges or user interaction and is network-based.

Compliance Impact

This vulnerability could lead to exposure of sensitive OAuth 1.0 parameters such as consumer keys, signatures, nonces, and timestamps, which may include personally identifiable information (PII) or protected health information (PHI) if processed by the application. Unauthorized cross-origin redirects could violate GDPR's data protection principles (Article 5) and HIPAA's security rule (45 CFR 164.308) by exposing confidential data to unintended hosts.

Mitigation Strategies

Upgrade ruby-oauth gem to version 1.1.6 or later immediately. Run: gem install oauth -v '1.1.6'. If upgrading is not possible, restrict token endpoint redirects to trusted same-origin URLs or disable cross-origin redirects entirely in OAuth::Consumer configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54605. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart