CVE-2026-54605

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54605", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T19:45:23.540Z", "datePublished": "2026-07-28T16:26:27.705Z", "dateUpdated": "2026-07-28T17:37:21.560Z"}, "containers": {"cna": {"title": "OAuth: Cross-origin token-request redirects can expose signed request metadata", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh"}, {"name": "https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f", "tags": ["x_refsource_MISC"], "url": "https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f"}, {"name": "https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6"}], "affected": [{"vendor": "ruby-oauth", "product": "oauth", "versions": [{"version": ">= 0.5.5, < 1.1.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-28T16:26:27.705Z"}, "descriptions": [{"lang": "en", "value": "OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6."}], "source": {"advisory": "GHSA-prq8-7wvh-44qh", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T17:37:16.671700Z", "id": "CVE-2026-54605", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T17:37:21.560Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54605", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T17:37:16.671700Z"}}}], "references": [{"url": "https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T17:37:07.602Z"}}], "cna": {"title": "OAuth: Cross-origin token-request redirects can expose signed request metadata", "source": {"advisory": "GHSA-prq8-7wvh-44qh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "ruby-oauth", "product": "oauth", "versions": [{"status": "affected", "version": ">= 0.5.5, < 1.1.6"}]}], "references": [{"url": "https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh", "name": "https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f", "name": "https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6", "name": "https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-28T16:26:27.705Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54605", "state": "PUBLISHED", "dateUpdated": "2026-07-28T17:37:21.560Z", "dateReserved": "2026-06-15T19:45:23.540Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-28T16:26:27.705Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "oauth", "vendor": "ruby-oauth", "versions": [{"status": "affected", "version": ">= 0.5.5, < 1.1.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6."}, {"lang": "es", "value": "OAuth es un wrapper de Ruby para los protocolos OAuth 1.0 y 1.0a, que proporciona clientes y servidores. Desde 0.5.5 hasta 1.1.5, OAuth::Consumer#token_request analiza el encabezado Location sin procesar de una redirecci\u00f3n 300 a 399 devuelta por el servidor OAuth y sigue la redirecci\u00f3n de forma recursiva, lo que puede mutar la configuraci\u00f3n del consumidor y exponer metadatos de solicitud OAuth firmados, incluyendo el encabezado de autorizaci\u00f3n, a un host de origen cruzado. Este problema se ha solucionado en la versi\u00f3n 1.1.6."}], "id": "CVE-2026-54605", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54605", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-28T17:37:16.671700Z", "version": "2.0.3"}}]}, "published": "2026-07-28T17:16:52.367", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f"}, {"source": "security-advisories@github.com", "url": "https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.5.5,1.1.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "oauth", "source": "cna", "vendor": "ruby-oauth"}, "product": "oauth", "vendor": "ruby-oauth"}], "created": "2026-07-28T20:34:05.246864+00:00", "updated": "2026-08-03T15:00:15.899957+00:00", "vendors": ["ruby-oauth", "ruby-oauth$PRODUCT$oauth"]}