Ruby-oauth Oauth vulnerabilities

• ruby-oauth oauth2 OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host CVE-2026-54603 Fix available 8.6 HighJuly 28, 2026
• cordea oauth OAuth: Cross-origin token-request redirects can expose signed request metadata CVE-2026-54605 Fix available 7.2 HighJuly 28, 2026