omniauth vulnerabilities

CVEs whose affected-version data names the omniauth package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-63183Medium· 6.9

2d ago

OmniAuth: Host Header Injection Vulnerability

OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host val…

▾ Sunlitomniauth · omniauthEPSS 0.18%via CVEORG