NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
💎
💎 RubyGems
Not in CISA KEV
CRITICAL severity

omniauth-saml vulnerable to Improper Verification of Cryptographic SignatureGHSA-cvp8-5r8g-fhvq

CRITICALFix: omniauth/omniauth-saml@4274e9d

GHSA-cvp8-5r8g-fhvq is a critical-severity (CVSS 10) vulnerability in omniauth-saml. A fix is available for omniauth-saml — see the affected versions and patch details below.

Published
Updated
Affected
3 pkgs
Patched
3 / 3
Exploits
None indexed
Exploitation data as of Aug 7, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

3 pkgs affected
💎omniauth-saml💎omniauth-saml💎omniauth-saml

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a new release by upgrading ruby-saml to the patched versions v1.17.

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
💎RubyGemsomniauth-saml≥ 2.0.0&&< 2.1.22.1.2bundle update omniauth-saml --conservative
💎RubyGemsomniauth-samlall versions1.10.5bundle update omniauth-saml --conservative
💎RubyGemsomniauth-saml≥ 2.2.0&&< 2.2.12.2.1bundle update omniauth-saml --conservative

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for omniauth-saml, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update omniauth-saml to 2.1.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-cvp8-5r8g-fhvq is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a [new release](https://github.com/omniauth/omniauth-saml/releases) by upgrading ruby-saml to the patched versions v1.17.
O3 Security · Impact-Aware SCA

Is GHSA-cvp8-5r8g-fhvq in your dependencies?

Find it across RubyGems, including transitive dependencies.

Scan my dependencies How O3 SCA works
omniauth-saml vulnerable to Improper Verification of…