What’s Vulnerable › Vulnerabilities

CVE-2015-9284: OmniAuth Ruby gem Cross-site Request Forgery in request phase

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-04-26 · updated 2026-06-17
• Weakness: CWE-352

Description

The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.

Affected products

• omniauth ruby gem: before 2.0.0 — fixed in 2.0.0
• Rubygems Omniauth: before 2.0.0; 0.0.1, 0.0.3, 0.0.4, 0.0.5, 0.1.0, 0.1.1 (+54) — fixed in 2.0.0

How to fix

Upgrade to a fixed version: omniauth ruby gem 2.0.0; Rubygems Omniauth 2.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/omniauth/omniauth-rails/pull/1
• https://github.com/omniauth/omniauth/pull/809
• https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
• https://www.openwall.com/lists/oss-security/2015/05/26/11
• https://github.com/omniauth/omniauth-rails/pull/1
• https://github.com/omniauth/omniauth/pull/809
• https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
• https://www.openwall.com/lists/oss-security/2015/05/26/11

Get alerted when CVE-2015-9284 or the next vulnerability affects your stack