OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value

CRITICO 9.8CVE-2020-36599 · GHSA-pm55-qfxr-h247 · Published 18/08/2022 · updated 17/06/2026

In breve

CVE-2020-36599 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda omniauth, omniauth (omniauth).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.2%, superiore al 67.3% delle vulnerabilità.
Correzione: aggiornare a 2.0.0, 1.9.2 o successiva.

Package	Affected versions	Patched versions
omniauth RubyGems	`≥ 2.0.0.pre.rc1, < 2.0.0< 1.9.2`	`2.0.01.9.2`
omniauth omniauth	`= 2.0.0< 1.9.2`	`1.9.2`

lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

NVD description

lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.