CVE-2020-36599: Omniauth

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

Affected products

• Omniauth Omniauth: before 1.9.2 (fixed in 1.9.2); version 2.0.0 only

Published 2022-08-18. Last modified 2026-06-17.