OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw L…

A security vulnerability exists in the Ruby OAuth gem (versions 0.5.5 through 1.1.5) where the OAuth::Consumer#token_request method improperly handles HTTP redirect responses (300-399 status codes). The method parses the raw Location header and follows redirects recursively without proper validation. This behavior can mutate the consumer's configuration and expose sensitive signed OAuth request metadata, including the Authorization header, to cross-origin hosts. The flaw enables potential credential and token leakage to attacker-controlled servers via redirect manipulation. The vulnerability affects both OAuth 1.0 and 1.0a protocol implementations within the gem. A fix has been released in version 1.1.6 of the Ruby OAuth gem. Users are strongly advised to upgrade to mitigate the risk of authorization header exposure and cross-origin data leakage.