CVE-2020-26254
1 advisory.
RubyGems/omniauth-apple CVE-2020-26254: high 7.7
omniauth-apple allows attacker to fake their email address during authentication
Action: Upgrade omniauth-apple to 1.0.1 or later.
bundle update omniauth-appleAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.1 | - |
Fixed versions
| 1.0.1 |
Sources
- osv: GHSA-49r3-2549-3633
- https://github.com/nhosoya/omniauth-apple/security/advisories/GHSA-49r3-2549-3633
- https://nvd.nist.gov/vuln/detail/CVE-2020-26254
- https://github.com/nhosoya/omniauth-apple/commit/b37d5409213adae2ca06a67fec14c8d3d07d9016
- https://github.com/nhosoya/omniauth-apple
- https://github.com/nhosoya/omniauth-apple/blob/master/CHANGELOG.md#101---2020-12-03
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-apple/CVE-2020-26254.yml
CVE-2020-26254 · published · modified · JSON