{"action":"Upgrade oauth to 1.1.6 or later.","affected":[{"fixed":"1.1.6","introduced":"0.5.5"}],"component":"oauth","cve_ids":["CVE-2026-54605"],"ecosystem":"RubyGems","epss":0.00188,"exploited":false,"fixed_versions":["1.1.6"],"ghsa_id":"GHSA-prq8-7wvh-44qh","id":"tcs_01M5KEMPZ87F7MEF4QGTM09PWZ","modified_at":"2026-07-28T16:35:58.982796Z","published_at":"2026-07-28T16:27:11Z","references":["https://osv.dev/vulnerability/GHSA-prq8-7wvh-44qh","https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh","https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f","https://github.com/ruby-oauth/oauth","https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-prq8-7wvh-44qh","url":"https://osv.dev/vulnerability/GHSA-prq8-7wvh-44qh"}],"summary":"OAuth: Cross-origin token-request redirects can expose signed request metadata"}