CVE-2026-54605

High

Advisory

Published 28 Jul 2026In the index since 8 Sept 2026

OAuth: Cross-origin token-request redirects can expose signed request metadata

Carried by container images the latest versions of 3 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
oauthgem	0.5.6, 1.1.0	1.1.6	2

3 by stars

Chart

Latest

Affected images

Radar Score

zammaddevplayer0

1 of the 4 container images this version deploys carry CVE-2026-54605.

Container image	Digest	Package	Fixed in
zammad/zammad-docker-compose :zammad-4.1.0-31	2808e2dfa810	oauth@0.5.6	1.1.6

6,110

chatwootmaxcrm-charts

1 of the 4 container images this version deploys carry CVE-2026-54605.

Container image	Digest	Package	Fixed in
chatwoot/chatwoot :v3.1.0	d530ab8c1753	oauth@1.1.0	1.1.6

5,940

1 of the 4 container images this version deploys carry CVE-2026-54605.

Container image	Digest	Package	Fixed in
chatwoot/chatwoot :v3.1.0	d530ab8c1753	oauth@1.1.0	1.1.6

5,940

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
chatwoot/chatwoot :v3.1.0	d530ab8c1753	oauth@1.1.0	1.1.6	2
zammad/zammad-docker-compose :zammad-4.1.0-31	2808e2dfa810	oauth@0.5.6	1.1.6	1