OAuth is a Ruby library that implements the OAuth 1.0 and 1.0a protocols. Between versions 0.5.5 and 1.1.5 the OAuth::Consumer#token_request method parsed the raw Location header of any HTTP 3xx redirect returned by an OAuth server and automatically followed that redirect. This logic allowed the redirect URL to change the consumer's configuration and, more critically, expose the token request’s signed Authorization header to a cross‑origin host. The data exposed includes sensitive OAuth credentials that could be used to impersonate the user or access protected resources. The weakness is a case of information exposure (CWE‑200) involving untrusted redirects (CWE‑918).

The vulnerability affects the ruby‑oauth library provided by the ruby‑oauth:oauth vendor. All releases from 0.5.5 through 1.1.5 are impacted. The issue was addressed in release 1.1.6, which removes the redirect‑following logic that leaked signed request metadata.

The CVSS score of 7.2 indicates a high severity level. The EPSS score of less than 1% suggests that the vulnerability has a low probability of exploitation in the wild, and it is not currently listed in the CISA KEV catalog. The likely attack vector is a remote attacker controlling the OAuth server or manipulating the redirect to a malicious host; the attacker would need to cause the client to process a 3xx response from the server. If successful, the attacker could capture the Authorization header and use it to forge requests on behalf of the legitimate user.