OAuth: Cross-origin token-request redirects can expose signed request metadata (CVE-2026-54605) | HOL Guard CVE