oauth

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

1. High, CVSS 7.2RubyGemsAmendedPublished 28 Jul 2026

   OAuth: Cross-origin token-request redirects can expose signed request metadata

   CVE-2026-54605 · GHSA-prq8-7wvh-44qh

   Affected

   • RubyGems oauth >= 0.5.5, <= 1.1.5

   Fixed in

   1.1.6· Vendor fix available

   Issue

   Cross-origin OAuth token-request redirects can expose signed request metadata Summary When an application uses OAuth::Consumer to request OAuth 1.0 request tokens or access tokens, the token request helper follows 300..399 redirects returned by the OAuth server. In affected versions, OAuth::Consumer#tokenrequest parses the raw Location header, follows the redirect recursively, and can mutate the consumer's configured site when the redirect points to a different host with the same path. The result is a cross-origin signed-request disclosure primitive: if an OAuth server token endpoint returns a redirect whose target an attacker controls, the client can re-sign the token request and send OAuth 1.0 request metadata, including the OAuth signature, nonce, timestamp, consumer key, and any request parameters included in the signature base string, to the attacker-controlled host. The same behavior can also be used as an SSRF or confused-deputy primitive because the application server follows…

   Recommended action: Upgrade to 1.1.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:osv.dev (1)github.com (2)Source checked 26 Oct 2026, 15:52 UTCEvidence →
2. High, CVSS 7.4RubyGemsPublished 22 Apr 2021

   Improper Certificate Validation in oauth ruby gem

   CVE-2016-11086 · GHSA-7359-3c6r-hfc2

   Affected

   • RubyGems oauth < 0.5.5

   Fixed in

   0.5.5· Vendor fix available

   Issue

   lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.

   Recommended action: Upgrade to 0.5.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 15:43 UTCEvidence →