CVE-2019-11027: SSRF vulnerability in ruby-openid
Summary
CVE-2019-11027: ruby-openid SSRF via claimed_id request. Affects ruby-openid versions < 2.9.0. Fixed in 2.9.0. How to fix ↓
Also tracked for
- ruby-openid · Debian:11
The same CVE-2019-11027 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby OpenID (ruby-openid) is a RubyGems package that provides OpenID integration for web applications. It allows users to authenticate themselves using OpenID providers. The vulnerability in ruby-openid allows an attacker to perform Server-Side Request Forgery (SSRF) by manipulating the claimed_id request. This can lead to unauthorized access to private servers and potential security breaches.
Vulnerability Detail
The vulnerability arises from the way ruby-openid performs discovery and verification. The discovery process is performed first, followed by verification. This sequential order allows an attacker to modify the URL used for discovery, tricking the server into connecting to a private server that is not publicly accessible. The severity of the vulnerability can range from medium to critical, depending on the implementation of the ruby-openid library in a web application. Developers who heavily relied on the 'example app' provided by the project are at higher risk.
How To Fix
Latest published version: 2.9.2 as of 23 Oct 2026
gem install ruby-openid -v 2.9.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.0
This is the first release that contains the fix.
gem install ruby-openid -v 2.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The SSRF vulnerability in ruby-openid (ruby-openid) can lead to unauthorized access to private servers and potential security breaches. It is crucial for developers to update their ruby-openid package to version 2.9.0 or higher to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby-openid →
FAQ
The vulnerability allows an attacker to perform SSRF, potentially gaining unauthorized access to private servers and sensitive information.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.
The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
Yes, updating the ruby-openid package to version 2.9.0 or higher will fix the vulnerability.
No specific workarounds have been mentioned for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby-openid.
