omniauth (RubyGems) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the RubyGems package omniauth, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (3)

• CVE-2020-36599 — CVSS 9.8 (critical): lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.
• CVE-2015-9284 — CVSS 8.8 (high): The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on…
• CVE-2017-18076 — CVSS 7.5 (high): In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters…