Skip to content
Threat Feed
Subscribe

Vendor

Ruby-Oauth

2 briefs RSS
high advisory

OAuth2::Client Redirection Vulnerability Leaks Bearer Tokens

The `OAuth2::Client` in the `oauth2` Ruby gem is vulnerable to credential disclosure and Server-Side Request Forgery (SSRF) due to improper handling of protocol-relative redirect URLs, allowing an attacker to steal bearer tokens and access internal network resources.

oauth2 ruby vulnerability credential-disclosure ssrf redirect ghsa
3t 3i
medium advisory

Cross-origin OAuth token-request redirects can expose signed request metadata

The 'oauth' Ruby gem versions 0.5.5 through 1.1.5 are vulnerable to a critical issue (CVE-2026-54605) where the 'OAuth::Consumer#token_request' method improperly handles HTTP 3xx redirects during OAuth 1.0 token exchanges, enabling an attacker to redirect the request to a malicious host, exposing sensitive OAuth 1.0 metadata, and facilitating Server-Side Request Forgery (SSRF) and confused-deputy behavior.

oauth vulnerability ssrf ruby gem web-application
3t