---
id: CVE-2026-54605
title: >-
  OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing
  clients and servers
summary: >-
  OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing
  clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses
  the raw Location header of a 300 to 399 redirect returned by the OAuth server
  and foll…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-200
  - CWE-346
  - CWE-918
vendor: oauth
product: oauth
affected:
  - 'oauth >= 0.5.5, <= 1.1.5'
patched:
  - oauth 1.1.6
published: '2026-07-28'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:50:00.950'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54605'
references:
  - url: >-
      https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f
    label: security-advisories@github.com
  - url: 'https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6'
    label: security-advisories@github.com
  - url: >-
      https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh
    label: security-advisories@github.com
  - url: >-
      https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-prq8-7wvh-44qh'
tags:
  - nvd
  - ghsa
  - rubygems
epss: 0.00188
epssPercentile: 0.0753
aliases:
  - GHSA-prq8-7wvh-44qh
ecosystem: rubygems
ingestedAt: '2026-07-28T16:37:04.399Z'
---

## Overview

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54605)

Affected packages:

- `oauth >= 0.5.5, <= 1.1.5`

Patched in:

- `oauth 1.1.6`

Source: https://github.com/advisories/GHSA-prq8-7wvh-44qh