{"action":"Upgrade omniauth-microsoft_graph to 2.0.0 or later.","affected":[{"fixed":"2.0.0","introduced":"0"}],"component":"omniauth-microsoft_graph","cve_ids":["CVE-2024-21632"],"ecosystem":"RubyGems","epss":0.00904,"exploited":false,"fixed_versions":["2.0.0"],"ghsa_id":"GHSA-5g66-628f-7cvj","id":"tcs_01M5KEH0HM0H1PAXJ2GPX0S28Q","modified_at":"2026-09-10T03:50:04.829983040Z","published_at":"2024-01-03T21:46:46Z","references":["https://osv.dev/vulnerability/GHSA-5g66-628f-7cvj","https://github.com/synth/omniauth-microsoft_graph/security/advisories/GHSA-5g66-628f-7cvj","https://nvd.nist.gov/vuln/detail/CVE-2024-21632","https://github.com/synth/omniauth-microsoft_graph/commit/5ffd62690ca0e46978f2fc7d83b18d28edde7795","https://github.com/synth/omniauth-microsoft_graph/commit/f132078389612b797c872b45bd0e0b47382414c1","https://github.com/synth/omniauth-microsoft_graph","https://www.descope.com/blog/post/noauth"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-5g66-628f-7cvj","url":"https://osv.dev/vulnerability/GHSA-5g66-628f-7cvj"}],"summary":"Omniauth::MicrosoftGraph Account takeover (nOAuth)"}