CSRF vulnerability: CVE 2013 4562

Mark Dodwell edited this page Nov 14, 2013 · 1 revision

There is a security vulnerability in the CSRF protection of omniauth-facebook 1.4.1. This vulnerability has been assigned the CVE identifier CVE-2013-4562.

Versions affected: 1.4.1
Not affected:      <= 1.4.0 (*)
Fixed versions:    >= 1.5.0

(*) Versions <= 1.4.0 did not have any CSRF protection. So, while this vulnerability does not directly affect versions <= 1.4.0, downgrading to <= 1.4.0 is not a fix.


Because of the way that omniauth-facebook supports setting a per-request state parameter by storing it in the session, it is possible to circumvent the automatic CSRF protection. Therefore the CSRF added in 1.4.1 should be considered broken.

If you are currently providing a custom state, you will need to store and retrieve this yourself (for example, by using the session store) to use 1.5.0.

All users running an affected release should upgrade to 1.5.0.


The 1.5.0 releases is available at the normal locations.




Egor Homakov (@homakov)

You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.
Press h to open a hovercard with more details.