CVE-2015-9284 — OmniAuth CSRF HIGH
🔴 CISA KEV
CVSS 7.4
CSRF in OAuth callback allows attackers to forge authentication requests. Any application using OmniAuth 1.x for OAuth is vulnerable — the callback accepts GET requests which can be triggered cross-site.
Affected package
| Package | Vulnerable | Safe version | Fix guide |
|---|---|---|---|
| omniauth | < 2.0.0 | 2.1.2 | Fix guide → |
Timeline
Dec 2015CVE filed for CSRF in OmniAuth 1.x OAuth callback
Feb 2021OmniAuth 2.0 released as the proper fix — POST-only callbacks
2021+CISA adds to KEV — exploitation confirmed against Rails apps
OngoingMany apps still on OmniAuth 1.x — still actively targeted
Paste your manifest — get a fixed version with all CVEs patched in seconds.
Open PackageFix →Free · No signup · No CLI · Runs in your browser
Common questions
How long has CVE-2015-9284 been exploited?
Despite being filed in 2015, it remained in widespread use through OmniAuth 1.x which was the default for years. CISA added it to KEV when exploitation against Rails applications was confirmed in 2021+. Many applications are still on OmniAuth 1.x.
What does the fix require?
OmniAuth 2.0+ requires POST-only OAuth callbacks. Add omniauth-rails_csrf_protection gem or configure your OAuth provider for POST callbacks. This is a breaking change but necessary.