# CVE-2026-54605: Ruby OAuth cross-origin metadata disclosure in token_request

Source: https://junglewise.ai/threats/cve-2026-54605-ruby-oauth-cross-origin-metadata-disclosure-in-token-request  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-54605 · Severity: high · CVSS 7.2 · Published 2026-07-28

The Ruby OAuth library, used to handle OAuth 1.0 authentication in applications, contains a vulnerability in how it handles server redirects. If a malicious or compromised authentication server sends a redirect, the library may automatically follow it and send sensitive authentication metadata—including digital signatures and consumer keys—to an unauthorized third-party server. This could lead to the exposure of integration secrets or allow an attacker to use the application server as a proxy to reach internal network resources.

Technologies: [oauth (RubyGems)](https://junglewise.ai/threats/technologies/oauth). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-54605 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54605 being exploited in the wild.

**How severe is CVE-2026-54605?** High severity, with a CVSS score of 7.2, published 28 July 2026.

**Which products and versions are affected?** oauth (RubyGems) >= 0.5.5, <= 1.1.5, ECOSYSTEM:introduced=0.5.5,fixed=1.1.6.

**Is there a fix for CVE-2026-54605?** Yes. oauth (RubyGems): upgrade to 1.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54605 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54605?** Check whether you run oauth (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- oauth (RubyGems): upgrade to 1.1.6 or later

  ```sh
  bundle update oauth
  ```


## Technical details

A vulnerability exists in `OAuth::Consumer#token_request` where the library recursively follows 3xx redirects without sufficient origin validation. When a redirect is received, the library may mutate the consumer's `@http` client and `options[:site]` configuration, subsequently re-signing the OAuth request for the new destination. An attacker who can influence the redirect target of an OAuth provider can capture signed request metadata, including the `Authorization` header, `oauth_signature`, and `oauth_nonce`. Additionally, because the application server initiates the redirected request, this can be leveraged for Server-Side Request Forgery (SSRF). The issue is resolved in version 1.1.6 by introducing a redirect limit and rejecting cross-origin redirects by default.

## Affected products

- ruby-oauth oauth >= 0.5.5, < 1.1.6

## Identifiers

- CVE-2026-54605
- GHSA-prq8-7wvh-44qh

## Timeline

- 2026-06-07: patched: Version 1.1.6 released
- 2026-07-28: disclosed: CVE-2026-54605 published

## References

- [https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f](https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f)
- [https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6](https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6)
- [https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh](https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh)

## Related threats

- [Improper Certificate Validation in oauth ruby gem](https://junglewise.ai/threats/cve-2016-11086-improper-certificate-validation-in-oauth-ruby-gem)