Filtered by vendor Omniauth
Subscriptions
Filtered by product Omniauth
Subscriptions
Total
4 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-63183 | 1 Omniauth | 1 Omniauth | 2026-11-04 | N/A |
| OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, creating a host header injection risk in applications whose web framework does not verify incoming host headers. Applications using appropriately configured Rails host authorization or a fixed full_host are not affected by this path. This issue is fixed in version 2.2.0. | ||||
| CVE-2020-36599 | 1 Omniauth | 1 Omniauth | 2024-11-21 | 9.8 Critical |
| lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value. | ||||
| CVE-2017-18076 | 2 Debian, Omniauth | 2 Debian Linux, Omniauth | 2024-11-21 | 7.5 High |
| In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase. | ||||
| CVE-2015-9284 | 1 Omniauth | 1 Omniauth | 2024-11-21 | 8.8 High |
| The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account. | ||||
Page 1 of 1.