CyberSecBulletin

Ruby-oauth vulnerabilities

We track 2 vulnerabilities in Ruby-oauth products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 28, 2026.

2vulnerabilities
0critical
2high
0exploited
7.9average CVSS score

Latest Ruby-oauth vulnerabilities

  • 7.2 High severity

    oauth: Exposure of Sensitive Information to an Unauthorized Actor

    CVE-2026-54605Ruby-oauth

    OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recurs

  • 8.6 High severity

    oauth2: Exposure of Sensitive Information to an Unauthorized Actor

    CVE-2026-54603Ruby-oauth

    OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Client#request overrides the request authority, so the bearer Authoriz