omniauth-oauth2 Cross-Site Request Forgery vulnerability

MEDIUM 6.8CVE-2012-6134 · GHSA-fgmx-8h93-26fh · Published 09/04/2013 · updated 16/06/2026

In short

CVE-2012-6134 is a MEDIUM (CVSS 6.8) vulnerability affecting omniauth-oauth2, omniauth-oauth2 (omniauth-oauth2 project).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 68.3% of all vulnerabilities.
Fix: update to 1.1.1 or later.

Package	Affected versions	Patched versions
omniauth-oauth2 RubyGems	`< 1.1.1`	`1.1.1`
omniauth-oauth2 omniauth-oauth2_project	`< 1.1.1`	`1.1.1`

Description

Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem prior to 1.1.1 for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.

NVD description

Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.

References

nvd.nist.gov/vuln/detail/CVE-2012-6134 · ADVISORY
Shopify/omniauth-shopify-oauth2#1 · WEB
intridea/omniauth-oauth2#25 · WEB
Shopify/omniauth-shopify-oauth2 · PACKAGE
rubysec/ruby-advisory-db · WEB
web.archive.org/web/20170312020947/https://gist.github.com/homakov/3673012 · WEB
rubysec.github.io/advisories/CVE-2012-6134 · WEB
seclists.org/oss-sec/2013/q1/304 · WEB
rubysec.github.io/advisories/CVE-2012-6134 · Broken Link
gist.github.com/homakov/3673012 · Broken Link

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free