OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value

CRÍTICO 9.8CVE-2020-36599 · GHSA-pm55-qfxr-h247 · Published 18/08/2022 · updated 17/06/2026

Em resumo

CVE-2020-36599 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta omniauth, omniauth (omniauth).
Chance de exploração nos próximos 30 dias (EPSS): 1.2%, maior que 67.3% das vulnerabilidades.
Correção: atualize para 2.0.0, 1.9.2 ou posterior.

Package	Affected versions	Patched versions
omniauth RubyGems	`≥ 2.0.0.pre.rc1, < 2.0.0< 1.9.2`	`2.0.01.9.2`
omniauth omniauth	`= 2.0.0< 1.9.2`	`1.9.2`

lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

NVD description

lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.