CVE-2026-54605

Name of the Vulnerable Software and Affected Versions oauth versions 0.5.5 through 1.1.5

Description When an application uses OAuth::Consumer to request OAuth 1.0 request or access tokens, the token request() function parses the raw Location header of 300 to 399 redirects returned by the OAuth server and follows them recursively. If a redirect points to a different host with the same path, the consumer's configured site can be mutated. This allows a cross-origin signed-request disclosure where the client may re-sign the token request and send OAuth 1.0 metadata—including the Authorization header, oauth signature, oauth nonce, oauth timestamp, and oauth consumer key—to an attacker-controlled host. Additionally, this behavior can be used for Server-Side Request Forgery (SSRF), where the application server initiates requests to unintended origins from its own network position, or as a confused-deputy primitive.

Recommendations Update oauth to version 1.1.6. As a temporary workaround, ensure configured OAuth token endpoints are fixed absolute URLs controlled by a trusted provider. As a temporary workaround, avoid using tenant-controlled OAuth token endpoint URLs unless the tenant is trusted to receive signed OAuth token requests. As a temporary workaround, block outbound application-server traffic to internal metadata services and other sensitive internal addresses at the network layer. As a temporary workaround, place a trusted proxy in front of OAuth providers that rejects token endpoint redirects to a different origin.