High severity7.5NVD Advisory· Published Jan 26, 2018· Updated Jun 17, 2026

CVE-2017-18076

Description

In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
omniauthRubyGems	< 1.3.2	1.3.2

Affected products

Omniauth/Omniauth
cpe:2.3:a:omniauth:omniauth:*:*:*:*:*:ruby:*:*
Range: <1.3.2
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
ghsa-coords
pkg:gem/omniauth
Range: < 1.3.2

Patches

Vulnerability mechanics

References

github.com/omniauth/omniauth/pull/867nvdPatchThird Party AdvisoryWEB
github.com/omniauth/omniauth/pull/867/commits/71866c5264122e196847a3980c43051446a03e9bnvdPatchThird Party AdvisoryWEB
bugs.debian.org/888523nvdIssue TrackingThird Party AdvisoryWEB
github.com/advisories/GHSA-9pr6-grf4-x2frghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2017-18076ghsaADVISORY
www.debian.org/security/2018/dsa-4109nvdThird Party AdvisoryWEB
github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth/CVE-2017-18076.ymlghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000