CVE-2026-54605

RubyGems/oauth CVE-2026-54605: high 7.2, EPSS 0.19%

OAuth: Cross-origin token-request redirects can expose signed request metadata

Action: Upgrade oauth to 1.1.6 or later.

bundle update oauth

Affected

Fixed versions

Sources

• osv: GHSA-prq8-7wvh-44qh
• https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh
• https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f
• https://github.com/ruby-oauth/oauth
• https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6

CVE-2026-54605 · published 2026-07-28T16:27:11Z · modified 2026-07-28T16:35:58.982796Z · JSON