https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T09:55:33.799187+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2018-04387 cnvd-2018-04387 2026-10-03T09:55:33.802896+00:00 cnvd-2018-04387 https://cve.radiocsirt.org/vuln/euvd-2026-79960 EUVD-2026-79960 2026-10-03T09:55:33.802929+00:00 EUVD-2026-79960 https://cve.radiocsirt.org/vuln/fkie_cve-2017-18076 fkie_cve-2017-18076 2026-10-03T09:55:33.802943+00:00

In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.

 https://cve.radiocsirt.org/vuln/ghsa-9pr6-grf4-x2fr GHSA-9pr6-grf4-x2fr — Omniauth allows POST parameters to be stored in session 2026-10-03T09:55:33.802970+00:00

Affected: RubyGems: omniauth

In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.

 https://cve.radiocsirt.org/vuln/gsd-2017-18076 gsd-2017-18076 2026-10-03T09:55:33.802992+00:00 gsd-2017-18076 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-18076 UBUNTU-CVE-2017-18076 2026-10-03T09:55:33.803003+00:00

Affected: Ubuntu:16.04:LTS: ruby-omniauth

In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.