Omniauth vulnerabilities

Products

• Saml 5
• Omniauth 3

Newest

• omniauth saml, onelogin ruby-saml, netapp storagegrid +2 more Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential) CVE-2025-25292 Fix available EPSS 65.1% 9.3 CriticalMarch 12, 2025
• omniauth saml, onelogin ruby-saml, netapp storagegrid +2 more ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential) CVE-2025-25291 Fix available EPSS 21.0% 9.3 CriticalMarch 12, 2025
• omniauth saml, onelogin ruby-saml +1 more ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses CVE-2025-25293 Fix available 7.7 HighMarch 12, 2025
• omniauth saml, onelogin ruby-saml, gitlab +1 more +3 more The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector CVE-2024-45409 Public exploitFix available EPSS 10.7% 10.0 CriticalSeptember 10, 2024
• omniauth OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value CVE-2020-36599 Fix available 9.8 CriticalAugust 18, 2022
• omniauth OmniAuth Ruby gem Cross-site Request Forgery in request phase CVE-2015-9284 Fix available 8.8 HighApril 26, 2019
• omniauth saml, omnitauth-saml +1 more Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal CVE-2017-11430 Fix available 7.7 HighApril 17, 2019
• omniauth, debian linux +1 more Omniauth allows POST parameters to be stored in session CVE-2017-18076 Fix available 7.5 HighJanuary 26, 2018