CVE-2017-18076: Vulnerability in omniauth
Summary
CVE-2017-18076: Omniauth allows POST parameters to be stored in session. Affects omniauth versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Also tracked for
- ruby-omniauth · Debian:11
The same CVE-2017-18076 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Omniauth is a RubyGem that provides a flexible authentication system for web applications. It allows users to authenticate using various external providers such as Facebook, Google, and Twitter. The gem simplifies the process of implementing multiple authentication strategies in a Ruby application. However, a vulnerability has been discovered in versions prior to 1.3.2 that could potentially expose sensitive information stored in the session.
Vulnerability Detail
The vulnerability (CVE-2017-18076) in OmniAuth before version 1.3.2 arises from the improper protection of the authenticity_token value. POST parameters, in addition to GET parameters, are stored in the session and become available in the environment of the callback phase. This can lead to unauthorized access to sensitive data and potential security breaches.
How To Fix
Latest published version: 2.3.1 as of 23 Oct 2026
gem install omniauth -v 2.3.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.2
This is the first release that contains the fix.
gem install omniauth -v 1.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of OmniAuth to ensure the security of your application.
Conclusion
In conclusion, the vulnerability (CVE-2017-18076) in OmniAuth versions prior to 1.3.2 can lead to unauthorized access to sensitive information stored in the session. It is crucial to upgrade to the fixed version to ensure the security of your application. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for omniauth →
FAQ
OmniAuth is a RubyGem that provides an authentication system for web applications, allowing users to authenticate using external providers.
This vulnerability could potentially expose sensitive information stored in the session, leading to unauthorized access and security breaches.
To fix this vulnerability, you should upgrade to OmniAuth version 1.3.2 or later.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/01/GHSA-9pr6-grf4-x2fr/GHSA-9pr6-grf4-x2fr.json
References
Related vulnerabilities
Recent vulnerabilities recorded for omniauth.
