CVE catalog
CVE-2026-54605
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect
- Severity
- High · CVSS 7.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.19% · Oct 25, 2026
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | ruby-oauth | sid | 1.1.9-1 | not affected |
| Debian | ruby-oauth | forky | 1.1.9-1 | not affected |
| Debian | ruby-oauth | trixie | 0.5.4-1.1 | not affected |
| Debian | ruby-oauth | bookworm | 0.5.4-1.1 | not affected |
| Rubygems | oauth | Not reported | 1.1.6 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | ruby-oauth | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | ruby-oauth | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | ruby-oauth | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | ruby-oauth | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Rubygems | oauth | rubygems | Not reported | 1.1.6 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [ruby-oauth]Not affected
Details (2)
0.5.4-1.1· all · bookwormNot affected
nvd · ruby-oauth · debian · bookworm
0.5.4-1.1· all · bookwormNot affected
nvd · ruby-oauth · debian · bookworm
Observed:
References
- [https://github.com/advisories/GHSA-prq8-7wvh-44qh]
- [https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f]
- [https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6]
- [https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-54605]
- [https://security-tracker.debian.org/tracker/CVE-2026-54605]
[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)]