Omniauth

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:omniauth:omniauth:*:*:*:*:*:ruby:*:*

part: a version: * update: *

VendorOmniauth (05e52dd3-caba-5347-a24f-6a595e88f28a)
ProductOmniauth (7d04c742-33be-5bd4-b4a0-f95908cb83f3)
Edition*
Language*
Software edition*
Target softwareruby
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:deb/debian/ruby-omniauth purl2cpe 2026-06-01 10:17:55.722702
pkg:deb/ubuntu/ruby-omniauth purl2cpe 2026-06-01 10:17:55.722703
pkg:gem/omniauth purl2cpe 2026-06-01 10:17:55.722705
pkg:github/omniauth/omniauth purl2cpe 2026-06-01 10:17:55.722706
pkg:rpm/opensuse/rubygem-omniauth purl2cpe 2026-06-01 10:17:55.722708

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2017-18076 vulnerable 2026-06-08 05:09:10.325516 Details available
In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.
Published: 2018-01-26T19:00:00.000Z
Updated: 2024-08-05T21:13:47.519Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2015-9284 vulnerable 2026-06-08 05:07:13.519671 Details available
The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.
Published: 2019-04-26T14:03:53.000Z
Updated: 2024-08-06T08:43:42.338Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.