Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-3r3w-8fxp-87ej
Vulnerability ID VCID-3r3w-8fxp-87ej
Aliases CVE-2019-11027
GHSA-fqfj-cmh6-hj49
Summary A vulnerability in OpenID library for Ruby at worst might allow an attacker to bypass authentication.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-918 Server-Side Request Forgery (SSRF)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-11027.json
epss 0.01731 https://api.first.org/data/v1/epss?cve=CVE-2019-11027
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-fqfj-cmh6-hj49
cvssv3.1 9.8 https://github.com/openid/ruby-openid
generic_textual CRITICAL https://github.com/openid/ruby-openid
cvssv3.1 9.8 https://github.com/openid/ruby-openid/commit/d181a8a2099c64365a1d24b29f6b6b646673a131
generic_textual CRITICAL https://github.com/openid/ruby-openid/commit/d181a8a2099c64365a1d24b29f6b6b646673a131
cvssv3 9.8 https://github.com/openid/ruby-openid/issues/122
cvssv3.1 9.8 https://github.com/openid/ruby-openid/issues/122
generic_textual CRITICAL https://github.com/openid/ruby-openid/issues/122
cvssv3.1 9.8 https://github.com/openid/ruby-openid/releases/tag/v2.9.0
generic_textual CRITICAL https://github.com/openid/ruby-openid/releases/tag/v2.9.0
cvssv3.1 9.8 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-openid/CVE-2019-11027.yml
generic_textual CRITICAL https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-openid/CVE-2019-11027.yml
cvssv3.1 9.8 https://lists.debian.org/debian-lts-announce/2019/10/msg00014.html
generic_textual CRITICAL https://lists.debian.org/debian-lts-announce/2019/10/msg00014.html
cvssv3.1 9.8 https://marc.info/?l=openid-security&m=155154717027534&w=2
generic_textual CRITICAL https://marc.info/?l=openid-security&m=155154717027534&w=2
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2019-11027
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2019-11027
cvssv3.1 9.8 https://security.gentoo.org/glsa/202003-09
generic_textual CRITICAL https://security.gentoo.org/glsa/202003-09
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-11027.json
https://api.first.org/data/v1/epss?cve=CVE-2019-11027
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11027
https://github.com/openid/ruby-openid
https://github.com/openid/ruby-openid/commit/d181a8a2099c64365a1d24b29f6b6b646673a131
https://github.com/openid/ruby-openid/issues/122
https://github.com/openid/ruby-openid/releases/tag/v2.8.0
https://github.com/openid/ruby-openid/releases/tag/v2.9.0
https://lists.debian.org/debian-lts-announce/2019/10/msg00014.html
https://marc.info/?l=openid-security&m=155154717027534&w=2
1719494 https://bugzilla.redhat.com/show_bug.cgi?id=1719494
930388 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930388
CVE-2019-11027 https://nvd.nist.gov/vuln/detail/CVE-2019-11027
CVE-2019-11027.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-openid/CVE-2019-11027.yml
GHSA-fqfj-cmh6-hj49 https://github.com/advisories/GHSA-fqfj-cmh6-hj49
GLSA-202003-09 https://security.gentoo.org/glsa/202003-09
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-11027.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/openid/ruby-openid
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/openid/ruby-openid/commit/d181a8a2099c64365a1d24b29f6b6b646673a131
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/openid/ruby-openid/issues/122
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/openid/ruby-openid/releases/tag/v2.9.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-openid/CVE-2019-11027.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2019/10/msg00014.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://marc.info/?l=openid-security&m=155154717027534&w=2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2019-11027
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://security.gentoo.org/glsa/202003-09
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.82865
EPSS Score 0.01731
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:55:56.043121+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/202003-09 38.6.0