{"action":"Upgrade omniauth-apple to 1.0.1 or later.","affected":[{"fixed":"1.0.1","introduced":"0"}],"component":"omniauth-apple","cve_ids":["CVE-2020-26254"],"ecosystem":"RubyGems","epss":0.01338,"exploited":false,"fixed_versions":["1.0.1"],"ghsa_id":"GHSA-49r3-2549-3633","id":"tcs_01M5KEGK61ABD9S3JTWW4PNTW7","modified_at":"2026-09-10T03:48:59.943436208Z","published_at":"2020-12-08T14:18:19Z","references":["https://osv.dev/vulnerability/GHSA-49r3-2549-3633","https://github.com/nhosoya/omniauth-apple/security/advisories/GHSA-49r3-2549-3633","https://nvd.nist.gov/vuln/detail/CVE-2020-26254","https://github.com/nhosoya/omniauth-apple/commit/b37d5409213adae2ca06a67fec14c8d3d07d9016","https://github.com/nhosoya/omniauth-apple","https://github.com/nhosoya/omniauth-apple/blob/master/CHANGELOG.md#101---2020-12-03","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-apple/CVE-2020-26254.yml"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-49r3-2549-3633","url":"https://osv.dev/vulnerability/GHSA-49r3-2549-3633"}],"summary":"omniauth-apple allows attacker to fake their email address during authentication"}