Skip to content
OpenAdvisories

Vendor

ruby-oauth

2 known vulnerabilities.

Products

oauth2 1 oauth 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.6
    CVE-2026-54603

    OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host

    OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Client#request overrides the request authority, so the bearer Authori…

    ruby-oauth oauth2 ruby-oauth2 oauth2 Debian Ubuntu RubyGems
  • High 7.2
    CVE-2026-54605

    OAuth: Cross-origin token-request redirects can expose signed request metadata

    OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recur…

    ruby-oauth oauth oauth ruby-oauth Ubuntu RubyGems