Skip to content
OpenAdvisories

Package · Debian

ruby-omniauth

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 6.9
    CVE-2026-63183

    OmniAuth: Host Header Injection Vulnerability

    OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured.…

    omniauth omniauth ruby-omniauth ruby-omniauth Debian Ubuntu
  • Critical 9.8
    CVE-2020-36599

    OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value

    lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

    ruby-omniauth ruby-omniauth omniauth Debian Ubuntu RubyGems
  • High 8.8
    CVE-2015-9284

    OmniAuth Ruby gem Cross-site Request Forgery in request phase

    The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This…

    ruby-omniauth ruby-omniauth omniauth Debian Ubuntu RubyGems
  • High 7.5
    CVE-2017-18076

    Omniauth allows POST parameters to be stored in session

    In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.

    ruby-omniauth ruby-omniauth omniauth Debian Ubuntu RubyGems