CVE-2026-54605: Ruby OAuth cross-origin metadata disclosure in token_request

CVE-2026-54605 · Severity: high · CVSS 7.2 · Published 2026-07-28

The Ruby OAuth library, used to handle OAuth 1.0 authentication in applications, contains a vulnerability in how it handles server redirects. If a malicious or compromised authentication server sends a redirect, the library may automatically follow it and send sensitive authentication metadata—including digital signatures and consumer keys—to an unauthorized third-party server. This could lead to the exposure of integration secrets or allow an attacker to use the application server as a proxy to reach internal network resources.

Technologies: oauth (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-54605 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54605 being exploited in the wild.
How severe is CVE-2026-54605?
High severity, with a CVSS score of 7.2, published 28 July 2026.
Which products and versions are affected?
oauth (RubyGems) >= 0.5.5, <= 1.1.5, ECOSYSTEM:introduced=0.5.5,fixed=1.1.6.
Is there a fix for CVE-2026-54605?
Yes. oauth (RubyGems): upgrade to 1.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54605 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54605?
Check whether you run oauth (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • oauth (RubyGems): upgrade to 1.1.6 or later
    bundle update oauth

Technical details

A vulnerability exists in `OAuth::Consumer#token_request` where the library recursively follows 3xx redirects without sufficient origin validation. When a redirect is received, the library may mutate the consumer's `@http` client and `options[:site]` configuration, subsequently re-signing the OAuth request for the new destination. An attacker who can influence the redirect target of an OAuth provider can capture signed request metadata, including the `Authorization` header, `oauth_signature`, and `oauth_nonce`. Additionally, because the application server initiates the redirected request, this can be leveraged for Server-Side Request Forgery (SSRF). The issue is resolved in version 1.1.6 by introducing a redirect limit and rejecting cross-origin redirects by default.

Affected products

  • ruby-oauth oauth >= 0.5.5, < 1.1.6

Identifiers

  • CVE-2026-54605
  • GHSA-prq8-7wvh-44qh

Timeline

  • 2026-06-07: patched: Version 1.1.6 released
  • 2026-07-28: disclosed: CVE-2026-54605 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.