Log in Start free

Vulnerability · Published Aug 29, 2025 · Assigned by GitHub_M

CVE-2025-58067Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URI

Medium 4.2

In plain English

A medium-severity open redirect in google_sign_in from basecamp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.2%top 85.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.1, it is possible to redirect a user to another origin if the "proceed_to" value in the session store is set to a protocol-relative URL. Normally the value of this URL is only written and read by the library or the calling application. However, it may be possible to set this session value from a malicious site with a form submission. Any Rails applications using the google_sign_in gem may be vulnerable, if this vector can be chained with another attack that is able to modify the OAuth2 request parameters. This issue has been patched in version 1.3.1. There are no workarounds.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
RubyGemsgoogle_sign_in1.3.1GHSA-5jch-xhw4-r43v

Affected products (as reported)

VendorProductVersions
basecamp google_sign_in < 1.3.1

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References