From 93f0382b2b76369518a7892849159268fbb4e112 Mon Sep 17 00:00:00 2001
From: Suleyman Musayev <slmusayev@gmail.com>
Date: Wed, 14 Oct 2026 20:06:13 +0500
Subject: [PATCH 1/3] Add omniauth_oidc GHSA-xgh2-jgvm-8g78

* Unsigned ID tokens (alg none) accepted in omniauth_oidc 1.0.0
  and 1.0.1 for the id_token flow; fixed in 1.1.0
---
 gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml | 50 ++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml

diff --git a/gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml b/gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml
new file mode 100644
index 0000000000..5b61793687
--- /dev/null
+++ b/gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml
@@ -0,0 +1,50 @@
+---
+gem: omniauth_oidc
+ghsa: xgh2-jgvm-8g78
+url: https://github.com/msuliq/omniauth_oidc/security/advisories/GHSA-xgh2-jgvm-8g78
+title: Unsigned ID tokens (alg none) accepted, allowing authentication
+  bypass in the id_token flow
+date: 2026-10-14
+description: |
+  ### Impact
+
+  omniauth_oidc 1.0.0 and 1.0.1 verified an ID token with whichever
+  signing algorithm the token's own header named, unless
+  `client_signing_alg` was configured. Because the header is controlled
+  by whoever produces the token, an unsigned token with `"alg": "none"`
+  passed signature verification.
+
+  Applications that use `response_type: "id_token"` (the implicit flow)
+  are affected. In that flow the ID token arrives in the callback
+  request parameters, so an attacker can start a login in their own
+  browser to obtain a valid `state` and `nonce`, then send the callback
+  an unsigned ID token carrying the victim's `sub`. The callback
+  completes with the victim's identity, which allows full account
+  takeover in the host application.
+
+  Applications that use the default authorization code flow
+  (`response_type: "code"`) are not exploitable this way, because the
+  ID token is obtained directly from the provider's token endpoint.
+
+  Versions before 1.0.0 used a different JWT library that rejects
+  `alg: none` when a key is supplied, and are not affected.
+
+  ### Patches
+
+  Fixed in 1.1.0. The accepted algorithms now come only from
+  configuration, and `none` is always rejected.
+
+  ### Workarounds
+
+  Set `client_signing_alg` to the algorithm your provider signs ID
+  tokens with (for example `client_signing_alg: "RS256"`), or use the
+  default `response_type: "code"` flow.
+cvss_v3: 9.1
+unaffected_versions:
+  - "< 1.0.0"
+patched_versions:
+  - ">= 1.1.0"
+related:
+  url:
+    - https://github.com/msuliq/omniauth_oidc/blob/main/CHANGELOG.md
+    - https://rubygems.org/gems/omniauth_oidc/versions/1.1.0

From f7d9ff2e40243512efb0c732570408d267bff69e Mon Sep 17 00:00:00 2001
From: Suleyman Musayev <slmusayev@gmail.com>
Date: Wed, 14 Oct 2026 20:35:56 +0500
Subject: [PATCH 2/3] Address review feedback for omniauth_oidc entry

* Link CHANGELOG to the 1.1.0 section
* Add GitHub advisory database URL to related urls
* Add notes on missing CVE and cvss_v3 source
---
 gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml b/gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml
index 5b61793687..66f1512245 100644
--- a/gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml
+++ b/gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml
@@ -46,5 +46,9 @@ patched_versions:
   - ">= 1.1.0"
 related:
   url:
-    - https://github.com/msuliq/omniauth_oidc/blob/main/CHANGELOG.md
+    - https://github.com/msuliq/omniauth_oidc/blob/main/CHANGELOG.md#110---2026-10-14
     - https://rubygems.org/gems/omniauth_oidc/versions/1.1.0
+    - https://github.com/advisories/GHSA-xgh2-jgvm-8g78
+notes: |
+  No CVE
+  cvss_v3 from GHSA URL.

From 0611e9891927db263a968cd10d9a79635c6d711a Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Sat, 17 Oct 2026 13:36:58 -0400
Subject: [PATCH 3/3] Update advisory URL in GHSA-xgh2-jgvm-8g78.yml

---
 gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml b/gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml
index 66f1512245..a2c3d7b1f0 100644
--- a/gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml
+++ b/gems/omniauth_oidc/GHSA-xgh2-jgvm-8g78.yml
@@ -48,7 +48,7 @@ related:
   url:
     - https://github.com/msuliq/omniauth_oidc/blob/main/CHANGELOG.md#110---2026-10-14
     - https://rubygems.org/gems/omniauth_oidc/versions/1.1.0
-    - https://github.com/advisories/GHSA-xgh2-jgvm-8g78
+    - https://github.com/msuliq/omniauth_oidc/security/advisories/GHSA-xgh2-jgvm-8g78
 notes: |
   No CVE
   cvss_v3 from GHSA URL.