PT-2025-35317 · Basecamp · Google Sign In

Muntrive · Published 2025-08-29 · Updated 2025-08-31 · CVE-2025-58067

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Basecamp's google sign in gem versions prior to 1.3.1

Description The gem persists a URL for redirection after authentication. If this URL is set to a protocol-relative URL, it improperly passes the "same origin" check, potentially redirecting a user to another origin after authentication. This could result in exposure of authentication information if chained with other attacks that modify OAuth2 request parameters. Any Rails applications using the gem may be vulnerable if this vector can be chained with another attack.

Recommendations Update to version 1.3.1 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-58067

GHSA-5JCH-XHW4-R43V

Affected Products

Google Sign In

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58067.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/google_sign_in/CVE-2025-58067.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-58067 · Security Note
• https://osv.dev/vulnerability/GHSA-5jch-xhw4-r43v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58067 · Vendor Advisory
• https://github.com/basecamp/google_sign_in/pull/75 · Note
• https://github.com/basecamp/google_sign_in/security/advisories/GHSA-5jch-xhw4-r43v · Note
• https://github.com/basecamp/google_sign_in/commit/e97aef4626b1bcbd2c6f01f7dd25f12ac855d4cc · Note
• https://github.com/basecamp/google_sign_in/releases/tag/v1.3.1 · Note
• https://github.com/basecamp/google_sign_in · Note
• https://twitter.com/CVEnew/status/1961541536149377039 · Twitter Post
• https://twitter.com/rubylandnews/status/1961962294398615642 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1961651228380701182 · Twitter Post
• https://t.me/CVEtracker/31286 · Telegram Post