Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Access token vulnerability: CVE 2013 4593
Clone this wiki locally
There is a security vulnerability in the omniauth-facebook <= 1.5.0. This vulnerability has been assigned the CVE identifier CVE-2013-4593.
Versions affected: <= 1.5.0 Fixed versions: >= 1.5.1
Because omniauth-facebook <= 1.5.0 supports passing an access token directly in the URL, an attacker may be able to authenticate as another user by passing a valid access token obtained from Facebook for another app.
If you're currently using this feature, and passing the access token directly, you should change your integration to use one of the secure methods using either a signed request or the code flow. These secure methods are default, so unless you are explicitly passing an access token you should not need to make any integration changes to upgrade to 1.5.1.
All users running an affected release should upgrade to 1.5.1 immediately.
The 1.5.1 release is available at the normal location.
Egor Homakov (@homakov)