How severe is GHSA-cvp8-5r8g-fhvq?

GHSA-cvp8-5r8g-fhvq has a CVSS score of 10/10, rated CRITICAL. Immediate patching is strongly recommended.

Which packages are affected by GHSA-cvp8-5r8g-fhvq?

GHSA-cvp8-5r8g-fhvq affects the following packages: omniauth-saml (RubyGems), omniauth-saml (RubyGems), omniauth-saml (RubyGems). Ecosystems affected: RubyGems.

How do I fix GHSA-cvp8-5r8g-fhvq?

Update omniauth-saml to 2.1.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-cvp8-5r8g-fhvq is resolved across your whole dependency graph.

How do I detect GHSA-cvp8-5r8g-fhvq in my RubyGems dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for omniauth-saml, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-cvp8-5r8g-fhvq if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-cvp8-5r8g-fhvq?

O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-cvp8-5r8g-fhvq can be triaged on real exposure rather than presence alone.

Is GHSA-cvp8-5r8g-fhvq actively exploited in the wild?

No public exploit code has been indexed for GHSA-cvp8-5r8g-fhvq yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-cvp8-5r8g-fhvq published, and has it been updated?

GHSA-cvp8-5r8g-fhvq was published on September 11, 2024 and was last updated on August 7, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

💎

💎 RubyGems

Not in CISA KEV

CRITICAL severity

GHSA-cvp8-5r8g-fhvq — omniauth-saml

CRITICALFix: omniauth/omniauth-saml@4274e9d

GHSA-cvp8-5r8g-fhvq is a critical-severity (CVSS 10) vulnerability in omniauth-saml. A fix is available for omniauth-saml — see the affected versions and patch details below.

omniauth-saml vulnerable to Improper Verification of Cryptographic Signature

Published

Sep 11, 2024

Updated

Aug 7, 2026

Affected

3 pkgs

Patched

3 / 3

Exploits

None indexed

Exploitation data as of Aug 7, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

3 pkgs affected

💎omniauth-saml💎omniauth-saml💎omniauth-saml

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a new release by upgrading ruby-saml to the patched versions v1.17.

Affected Packages

3 total 3 fixed

Ecosystem	Package	Vulnerable range	Fix
💎RubyGems	`omniauth-saml`	≥ 2.0.0&&< 2.1.2	2.1.2`bundle update omniauth-saml --conservative`
💎RubyGems	`omniauth-saml`	all versions	1.10.5`bundle update omniauth-saml --conservative`
💎RubyGems	`omniauth-saml`	≥ 2.2.0&&< 2.2.1	2.2.1`bundle update omniauth-saml --conservative`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for omniauth-saml, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update omniauth-saml to 2.1.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-cvp8-5r8g-fhvq is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-cvp8-5r8g-fhvq can be triaged on real exposure rather than presence alone.

Tailored to GHSA-cvp8-5r8g-fhvq. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a [new release](https://github.com/omniauth/omniauth-saml/releases) by upgrading ruby-saml to the patched versions v1.17.

O3 Security · Impact-Aware SCA

Is GHSA-cvp8-5r8g-fhvq in your dependencies?

O3 Security finds GHSA-cvp8-5r8g-fhvq across RubyGems dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works