CVE-2024-21632 — omniauth-microsoft_graph vulnerable to account takeover (nOAuth)
omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the `email` at…
Published: 2024-01-02 · CVSS: 8.6 · CVSS 3.1
omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the `email` attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases when the `email` is used as a trusted user identifier. This could lead to account takeover. Version 2.0.0 contains a fix for this issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7