CVE-2026-54605: ruby-oauth oauth
Vulnerability summary
CVE-2026-54605 is a high (CVSS 7.2) vulnerability in ruby-oauth oauth. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8% of scored vulnerabilities.
Timeline
- 28-07-2026PublishedVulnerability first disclosed.
- 28-07-2026Last modifiedVulnerability information updated.
Description
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- OSV · RubygemsEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
+0.06 pp
From 0.13% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-346Origin Validation ErrorThe product does not properly verify that the source of data or communication is valid.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Chainguard20 products
- commercial-gitlab-rails-ee-19.1All versions (No fix recorded)
- commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
- gitlab-rails-ce-18.1All versions (No fix recorded)
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.11All versions (No fix recorded)
Ruby-oauth1 product
- oauth≥ 0.5.5, < 1.1.6
RubyGems1 product
- oauth≥ 0.5.5, < 1.1.6
Ubuntu1 product
- ruby-oauthAll versions (No fix recorded)
4 vendors · 23 products
References
8 links- github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qhX Refsource CONFIRMREPORTAdvisoryWEB
- github.com/ruby-oauth/oauthPACKAGE