PT-2026-65538 · Ruby Oauth · Oauth

CVE-2026-54605 · Publicado 2026-07-28 · Atualizado 2026-07-28

NVD

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6.

Exploit

Correção

SSRF

Information Disclosure

Origin Validation Error

Enumeração de Fraquezas

CWE-918

CWE-200

CWE-346

Identificadores relacionados

CVE-2026-54605

Produtos afetados

Oauth

Referências · 4

• 🔥 https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh · Exploit
• https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6 · Nota
• https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-54605 · Nota de Segurança