Vulnerability GHSA-m27g-v28p-f9fx
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
6 hours ago
November 09, 2026 at 09:49 PM UTC
OmniAuth: Host Header Injection Vulnerability
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.9.2 and 2.0.0.pre.rc1 and 2.0.0 - 2.1.4
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.9.2 and 2.0.0.pre.rc1 and 2.0.0 - 2.1.4
Summary
OmniAuth: Host Header Injection Vulnerability
Details
Impact
Host header injection risk when using Omniauth with a web framework that does not verify incoming host headers. An example of a framework that provides host header validation is modern Rails when configured appropriately
Patches
2.2.0
Workarounds
Set the full_host config in the Omniauth config
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
4 years ago
OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.9.1 and 2.0.0.pre.rc1 GHSA-pm55-qfxr-h247
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.9.1 and 2.0.0.pre.rc1 GHSA-pm55-qfxr-h247
High Risk
7 years ago
OmniAuth Ruby gem Cross-site Request Forgery in request phase
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.9.2 and 2.0.0.pre.rc1 GHSA-ww4x-rwq6-qpgf
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.9.2 and 2.0.0.pre.rc1 GHSA-ww4x-rwq6-qpgf
High Risk
8 years ago
Omniauth allows POST parameters to be stored in session
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.3.1 GHSA-9pr6-grf4-x2fr
0.0.1 and 0.0.3 - 0.1.6 and 0.2.0.beta1 and 0.2.0.beta2 and 0.2.0.beta3 and 0.2.0.beta4 and 0.2.0.beta5 and 0.2.0 - 0.2.6 and 0.3.0.rc3 and 0.3.0 and 0.3.2 and 1.0.0.beta1 and 1.0.0.pr1 and 1.0.0.pr2 and 1.0.0.rc1 and 1.0.0.rc2 and 1.0.0 - 1.1.4 and 1.2.1 - 1.3.1 GHSA-9pr6-grf4-x2fr
Impacted packages
Timeline
Published
6 hours ago
November 09, 2026 at 09:49 PM UTC
Last Modified
6 hours ago
November 09, 2026 at 10:00 PM UTC