CVE-2026-54605

{
  "id": "CVE-2026-54605",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-28T17:16:52.367",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. This issue is fixed in version 1.1.6."
    },
    {
      "lang": "es",
      "value": "OAuth es un wrapper de Ruby para los protocolos OAuth 1.0 y 1.0a, que proporciona clientes y servidores. Desde 0.5.5 hasta 1.1.5, OAuth::Consumer#token_request analiza el encabezado Location sin procesar de una redirección 300 a 399 devuelta por el servidor OAuth y sigue la redirección de forma recursiva, lo que puede mutar la configuración del consumidor y exponer metadatos de solicitud OAuth firmados, incluyendo el encabezado de autorización, a un host de origen cruzado. Este problema se ha solucionado en la versión 1.1.6."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ruby-oauth",
          "product": "oauth",
          "versions": [
            {
              "version": ">= 0.5.5, < 1.1.6",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-28T17:37:16.671700Z",
          "id": "CVE-2026-54605",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}