CVE-2026-54605 in oauth
Summary
by MITRE • 07/28/2026
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The OAuth gem vulnerability represents a critical security flaw in the Ruby implementation of OAuth 1.0 and 1.0a protocols that affects versions between 0.5.5 and 1.1.5. This vulnerability stems from improper handling of HTTP redirect responses during the token request process, creating an avenue for information disclosure and potential authentication bypass scenarios. The flaw specifically manifests when the OAuth::Consumer#token_request method processes Location headers from redirects in the 300 to 399 range, which are typically used for redirection in web applications.
The technical implementation of this vulnerability involves recursive redirect following behavior that allows malicious servers to manipulate the consumer's configuration through crafted redirect responses. When a 300 to 399 status code is encountered, the vulnerable code parses the raw Location header and automatically follows redirects without proper validation or origin checking. This recursive redirect handling can be exploited by attackers who control the OAuth server to redirect requests to malicious hosts, thereby exposing sensitive authentication metadata including the Authorization header that contains signed OAuth request parameters.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable unauthorized access to protected resources and compromise the integrity of the authentication flow. Attackers can leverage this flaw to capture signed OAuth request metadata, which includes tokens, signatures, and other critical authentication components that should remain confidential within the intended trust boundaries. This exposure creates opportunities for credential theft, session hijacking, and unauthorized API access against applications using vulnerable versions of the OAuth gem.
The vulnerability aligns with CWE-203 Information Exposure Through Discrepancy and CWE-611 Improper Restriction of XML External Entity Reference, as it exposes sensitive information through redirect handling mechanisms and allows cross-origin data leakage. From an ATT&CK perspective, this issue maps to T1566 Credential Access through the exploitation of authentication protocol weaknesses and T1071.004 Application Layer Protocol: DNS for potential DNS-based redirection attacks. The fix implemented in version 1.1.6 addresses this by introducing proper redirect validation and preventing automatic following of redirects that could lead to cross-origin exposure, ensuring that OAuth request metadata remains protected within the intended security boundaries.
Organizations using affected versions of the OAuth gem should immediately upgrade to version 1.1.6 or later to remediate this vulnerability. Additional mitigations include implementing proper input validation for redirect responses, configuring network-level restrictions on external redirects, and monitoring for unusual redirect patterns in authentication flows. Security teams should also conduct comprehensive audits of all applications using the OAuth gem to identify potential exposure points and ensure that appropriate security controls are in place to prevent similar vulnerabilities from manifesting in other components of their authentication infrastructure.