| Package | Affected versions | Patched versions |
|---|---|---|
| omniauth | ≥ 2.0.0.pre.rc1, < 2.0.0< 1.9.2 | 2.0.01.9.2 |
| omniauth | = 2.0.0< 1.9.2 | 1.9.2 |
lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free