← Back

Recognizeapp

recognizeapp

1 CVE • 1 product

Products (1)

Click to collapse
Toggle
Omniauth\
omniauth\
1 CVE

CVEs (1)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-21632
1Recognizeapp
1Omniauth\
Jun 17, 2026
Jan 2, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the `email` attribute of the user nor did it give/documen...Show more
omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the `email` attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases when the `email` is used as a trusted user identifier. This could lead to account takeover. Version 2.0.0 contains a fix for this issue. Show less