[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2KqSPQpnspdWu3FDCQvapmVweYrY12Bu8QBIOufdYns":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":27,"kevVulnerabilities":73,"topProductsByCves":74,"seoMetadata":77,"meta":86},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":26},22548,"omniauth",2,8,0,91,"2025-03-12","o",[16,21],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},121464,"omniauth_saml",33,5,{"id":22,"product_name":8,"version_count":23,"cve_count":24,"kev_count":11,"last_cve_update":25},121463,58,3,"2022-08-18","Omniauth is a technology vendor with 2 tracked products and 8 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[28,36,40,46,52,59,63,69],{"cveId":29,"description":30,"publishedDate":13,"cvssScore":31,"cvssVersion":32,"severity":33,"isKev":34,"epssScore":35},"CVE-2025-25292","ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 contain a patch for the issue.",9.8,"v3.1","Critical",false,0.65086,{"cveId":37,"description":38,"publishedDate":13,"cvssScore":31,"cvssVersion":32,"severity":33,"isKev":34,"epssScore":39},"CVE-2025-25291","ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.",0.20965,{"cveId":41,"description":42,"publishedDate":43,"cvssScore":44,"cvssVersion":32,"severity":33,"isKev":34,"epssScore":45},"CVE-2024-45409","The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in \u003C= 12.2 and 1.13.0 \u003C= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response\u002FAssertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.","2024-09-10",10,0.10684,{"cveId":47,"description":48,"publishedDate":49,"cvssScore":31,"cvssVersion":50,"severity":33,"isKev":34,"epssScore":51},"CVE-2017-11430","OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.","2019-04-17","v3.0",0.02435,{"cveId":53,"description":54,"publishedDate":55,"cvssScore":56,"cvssVersion":32,"severity":57,"isKev":34,"epssScore":58},"CVE-2017-18076","In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.","2018-01-26",7.5,"High",0.02129,{"cveId":60,"description":61,"publishedDate":13,"cvssScore":56,"cvssVersion":32,"severity":57,"isKev":34,"epssScore":62},"CVE-2025-25293","ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue.",0.01528,{"cveId":64,"description":65,"publishedDate":66,"cvssScore":67,"cvssVersion":32,"severity":57,"isKev":34,"epssScore":68},"CVE-2015-9284","The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.","2019-04-26",8.8,0.01525,{"cveId":70,"description":71,"publishedDate":25,"cvssScore":31,"cvssVersion":32,"severity":33,"isKev":34,"epssScore":72},"CVE-2020-36599","lib\u002Fomniauth\u002Ffailure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.",0.01163,[],[75,76],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},{"id":22,"product_name":8,"version_count":23,"cve_count":24,"kev_count":11,"last_cve_update":25},{"title":78,"metaDescription":79,"keywords":80,"structuredData":81},"Omniauth - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Omniauth covering 2 products with 8 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Omniauth vulnerabilities, Omniauth security, Omniauth CVE, Omniauth threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":82,"@type":83,"name":84,"description":79,"url":85},"https:\u002F\u002Fschema.org","Organization","Omniauth","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fomniauth",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":87,"apiVersion":88},"2026-10-18T19:50:17.887Z","3.0"]