GHSA-m27g-v28p-f9fx

Suggest an improvement
Source
https://github.com/advisories/GHSA-m27g-v28p-f9fx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m27g-v28p-f9fx/GHSA-m27g-v28p-f9fx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m27g-v28p-f9fx
Aliases
Downstream
CGA (44)
Published
2026-11-09T21:49:04Z
Modified
2026-11-09T22:00:06Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
OmniAuth: Host Header Injection Vulnerability
Details

Impact

Host header injection risk when using Omniauth with a web framework that does not verify incoming host headers. An example of a framework that provides host header validation is modern Rails when configured appropriately

Patches

2.2.0

Workarounds

Set the full_host config in the Omniauth config

Database specific 
{
    "cwe_ids": [
        "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-09T21:49:04Z",
    "nvd_published_at": "2026-11-04T19:17:40Z",
    "severity": "MODERATE"
}
References

Affected packages

RubyGems / omniauth

Package

Name
omniauth
Purl
pkg:gem/omniauth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.0

Affected versions

0.*
0.0.1
0.0.3
0.0.4
0.0.5
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.2.0.beta1
0.2.0.beta2
0.2.0.beta3
0.2.0.beta4
0.2.0.beta5
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.3.0.rc3
0.3.0
0.3.2
1.*
1.0.0.beta1
1.0.0.pr1
1.0.0.pr2
1.0.0.rc1
1.0.0.rc2
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.2.1
1.2.2
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
2.*
2.0.0.pre.rc1
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m27g-v28p-f9fx/GHSA-m27g-v28p-f9fx.json"