CVE-2012-6134: Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allow...

Security readout for executives and security teams

This issue affects Ruby applications using omniauth-oauth2 1.1.1 or earlier. A malicious site could abuse a logged-in user's browser to alter authentication session state, potentially linking or hijacking authentication context without the user's intent. Exposure is most likely in older Ruby applications that still depend on omniauth-oauth2 1.1.1 or earlier for OAuth authentication flows. Applications not using this gem or not using affected versions are not indicated as exposed by the provided sources. Treat this as a dependency hygiene and authentication integrity issue. It is old and not KEV-listed in the bundle, but exposed legacy OAuth login paths can create account trust and incident-response risk. Mitigation focus: Inventory Ruby applications for omniauth-oauth2 dependency versions.; Check RubySec and upstream project guidance for the fixed release.; Move off version 1.1.1 or earlier when a fixed upgrade path is confirmed..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.