| Package | Affected versions | Patched versions |
|---|---|---|
| devise_token_auth | ≥ 0.1.33, < 1.1.3 | 1.1.3 |
| devise token auth | ≥ 0.1.33, ≤ 1.1.2 |
An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting (XSS) through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects the fallback_render method in the omniauth callbacks controller.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free