PatchTheCVEomniauth vulnerabilities
Recent CVEs affecting omniauth products. 4 tracked.
omniauth has 4 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-03-12. Highest priority: CVE-2025-25292 (score 72/100).
- CVE-2025-25293 HIGH 7.5 UPGRADE UPGRADE ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
- CVE-2025-25292 CRITICAL 9.8 UPGRADE UPGRADE ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
- CVE-2025-25291 CRITICAL 9.8 UPGRADE UPGRADE ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
- CVE-2024-45409 CRITICAL 10.0 UPGRADE UPGRADE The Ruby SAML library is for implementing the client side of a SAML authorization
FAQ
How do I fix omniauth vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is omniauth being exploited right now?
None of the tracked omniauth CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which omniauth CVE should I patch first?
CVE-2025-25292 currently ranks highest (72/100): ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby.