-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the unescaped message_key value being directly interpolated into the redirect URL in FailureEndpoint. The GitHub advisory specifically references failure_endpoint.rb and the patched commit shows escaping was added to message_key in this method. The CWE-116 classification confirms this is an output encoding issue at this location.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| omniauth | rubygems | < 1.9.2 | 1.9.2 |
| omniauth | rubygems | = 2.0.0.pre.rc1 | 2.0.0 |