{"cve":"CVE-2025-57821","nvd":{"published":"2025-08-27T17:15:48.057","modified":"2026-06-17T09:43:30.010","status":"Deferred","description":"Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.0, it is possible to craft a malformed URL that passes the \"same origin\" check, resulting in the user being redirected to another origin. Rails applications configured to store the flash information in a session cookie may be vulnerable, if this can be chained with an attack that allows injection of arbitrary data into the session cookie. This issue has been patched in version 1.3.0. If upgrading is not possible at this time, a way to mitigate the chained attack can be done by explicitly setting SameSite=Lax or SameSite=Strict on the application session cookie.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","score":4.2},"cwes":["CWE-601"],"references":["https://github.com/basecamp/google_sign_in/commit/85903651201257d4f14b97d4582e6d968ac32f15","https://github.com/basecamp/google_sign_in/pull/73","https://github.com/basecamp/google_sign_in/releases/tag/v1.3.0","https://github.com/basecamp/google_sign_in/security/advisories/GHSA-7pwc-wh6m-44q3"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:07:46.309729541+00:00"},"epss":{"cve":"CVE-2025-57821","score":0.0025,"percentile":0.16395,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-7pwc-wh6m-44q3","url":"https://osv.dev/vulnerability/GHSA-7pwc-wh6m-44q3","summary":"Google Sign-In for Rails allowed redirects to malformed URLs","modified":"2025-08-29T15:49:18.210384Z","packages":[{"ecosystem":"RubyGems","name":"google_sign_in","purl":"pkg:gem/google_sign_in","ranges":["<1.3.0"],"fixed":["1.3.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}