CVE-2026-54605: OAuth Ruby Information Disclosure Flaw

CVE-2026-54605 Overview

CVE-2026-54605 affects the oauth Ruby gem, a wrapper for the OAuth 1.0 and 1.0a protocols used by clients and servers. The OAuth::Consumer#token_request method parses the raw Location header of a 3xx redirect returned by an OAuth server and follows the redirect recursively. This behavior can mutate the consumer's configuration and leak signed OAuth request metadata, including the Authorization header, to a cross-origin host. The flaw impacts versions 0.5.5 through 1.1.5 and is fixed in version 1.1.6. The Common Weakness Enumeration classification is [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
An attacker-controlled or malicious OAuth server can redirect token requests to a cross-origin endpoint, harvesting signed OAuth Authorization headers and enabling re-signing of token requests toward attacker-controlled URLs.

Affected Products

oauth Ruby gem versions 0.5.5 through 1.1.5
Ruby applications using OAuth::Consumer#token_request for OAuth 1.0/1.0a flows
Downstream libraries and services depending on the vulnerable oauth gem versions

Discovery Timeline

2026-07-28 - CVE-2026-54605 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-54605

Vulnerability Analysis

The oauth gem exposes OAuth::Consumer#token_request to obtain request and access tokens from an OAuth 1.0a provider. When the provider responds with an HTTP status between 300 and 399, the consumer parses the raw Location header and follows the redirect recursively without validating that the target host matches the original consumer configuration. Because OAuth 1.0a signatures include the request URL and headers, the consumer re-signs and re-sends the request to the new location. The redirected request carries the original Authorization header and newly generated signed metadata to a host chosen by the server response.

The vulnerability falls under [CWE-200] because signed OAuth credentials and request metadata are disclosed to an unauthorized cross-origin party. Impact includes disclosure of consumer keys, signatures, timestamps, nonces, and potentially token secrets embedded in follow-up requests. An attacker operating or compromising an OAuth endpoint can capture these values and replay or forge subsequent OAuth interactions.

Root Cause

The root cause is the absence of origin validation and redirect limits when handling 3xx responses in lib/oauth/consumer.rb. Cross-origin redirects were followed by default, and the consumer's internal configuration could be mutated during the recursive redirect chain.

Attack Vector

Exploitation requires that an OAuth consumer using the affected gem issues a token request to an endpoint controlled or influenced by the attacker. The attacker responds with a 3xx status and a Location header pointing to a cross-origin host. The Ruby client follows the redirect, re-signs the request, and transmits the signed Authorization header to the attacker.

ruby

# Patch excerpt from lib/oauth/consumer.rb (v1.1.6)
        body_hash_enabled: true,

        oauth_version: "1.0",

        # Token endpoint redirects are followed only within the same origin by
        # default. Cross-origin redirects can re-sign token requests for an
        # attacker-controlled endpoint, so they require explicit opt-in.
        token_request_max_redirects: 10,
        token_request_cross_origin_redirects: false,
      },
    )

Source: GitHub Commit d069dc8. The patch introduces token_request_max_redirects and token_request_cross_origin_redirects, disabling cross-origin redirect following by default.

Detection Methods for CVE-2026-54605

Indicators of Compromise

Outbound HTTP requests from Ruby application hosts to unexpected domains carrying Authorization: OAuth headers
OAuth provider logs showing 3xx responses immediately followed by requests to unrelated hosts with the same oauth_nonce or oauth_timestamp
Application logs recording repeated token_request retries traversing multiple hostnames within a single call chain

Detection Strategies

Inventory Ruby application dependencies and identify usage of the oauth gem at versions 0.5.5 through 1.1.5 via Gemfile.lock or bundle list
Instrument HTTP client middleware to log the destination host of any redirect chain originating from OAuth::Consumer#token_request
Compare the host in OAuth token request URLs against the destination host of subsequent requests within the same session

Monitoring Recommendations

Alert on egress traffic containing OAuth Authorization headers destined for hosts not present in an approved OAuth provider allowlist
Monitor for HTTP 3xx responses from OAuth endpoints followed by cross-origin requests within the same TLS session or process
Track deployments of the oauth gem across CI/CD pipelines and flag any pinned version older than 1.1.6

How to Mitigate CVE-2026-54605

Immediate Actions Required

Upgrade the oauth gem to version 1.1.6 or later in all Ruby projects and rebuild deployment artifacts
Rotate OAuth consumer keys, consumer secrets, and any tokens issued through affected code paths in case metadata was exposed
Audit historical outbound HTTP traffic from Ruby workloads for anomalous cross-origin redirects during OAuth token exchanges

Patch Information

The fix is available in oauth version 1.1.6. Details are documented in GitHub Security Advisory GHSA-prq8-7wvh-44qh and the remediation commit at ruby-oauth/oauth@d069dc8. The patch adds token_request_max_redirects (default 10) and token_request_cross_origin_redirects (default false).

Workarounds

Pin OAuth provider endpoints to trusted hosts and reject responses whose Location header points outside the approved origin at the HTTP client layer
Wrap OAuth::Consumer#token_request calls with a custom HTTP adapter that refuses to follow 3xx responses until the gem is upgraded
Restrict egress from application hosts to a curated allowlist of OAuth provider domains via network policy

bash

# Upgrade the oauth gem to the patched release
bundle update oauth --conservative
bundle list | grep '^  \* oauth '
# Verify version is >= 1.1.6