Basecamp's Google Sign-In for Rails allowed redirects to a malformed URL
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.
Summary
Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.0, it is possible to craft a malformed URL that passes the "same origin" check, resulting in the user being redirected to another origin. Rails applications configured to store the flash information in a session cookie may be vulnerable, if this can be chained with an attack that allows injection of arbitrary data into the session cookie. This issue has been patched in version 1.3.0. If upgrading is not possible at this time, a way to mitigate the chained attack can be done by explicitly setting SameSite=Lax or SameSite=Strict on the application session cookie.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| basecamp | google_sign_in | before 1.3.0 | 1.3.0 | Patch available | CNA |
| — | google_sign_in (RubyGems) | before 1.3.0 | 1.3.0 | Patch available | GHSA-7pwc-wh6m-44q3 |
- google_sign_in Vendorbasecamp Affected before 1.3.0 Fixed in 1.3.0 Patch available CNA
- google_sign_in (RubyGems) Vendor— Affected before 1.3.0 Fixed in 1.3.0 Patch available GHSA-7pwc-wh6m-44q3
Remediation
- Fix · CNA google_sign_in (basecamp) Fixed in 1.3.0
- Fix · GHSA-7pwc-wh6m-44q3 google_sign_in (RubyGems) Fixed in 1.3.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-57821
- 2026-10-03 Alias added: GHSA-7pwc-wh6m-44q3
References
Other 7
- https://github.com/basecamp/google_sign_in/security/advisories/GHSA-7pwc-wh6m-44q3
- https://github.com/basecamp/google_sign_in/pull/73
- https://github.com/basecamp/google_sign_in/commit/85903651201257d4f14b97d4582e6d968ac32f15
- https://github.com/basecamp/google_sign_in/releases/tag/v1.3.0
- https://github.com/basecamp/google_sign_in/commit/a0548a604fb17e4eb1a57029f0d87e34e8499623
- https://github.com/basecamp/google_sign_in
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/google_sign_in/CVE-2025-57821.yml
More basecamp vulnerabilities
- TI-2023-18436 Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1… CVSS 3.1HIGH 7.5
- TI-2024-29019 Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste CVSS 3.1MEDIUM 6.5
- TI-2024-36043 Trix vulnerable to Cross-site Scripting on copy & paste CVSS 4.0MEDIUM 5.1
- TI-2018-16075 easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in… CVSS 3.1MEDIUM 6.1
- TI-2024-22682 The Trix Editor Contains an Arbitrary Code Execution Vulnerability CVSS 3.1MEDIUM 5.4
- TI-2025-15570 Trix allows Cross-site Scripting via `javascript:` url in a link CVSS 3.1MEDIUM 5.3
Sources
- CVE-2025-57821 · CVE Program
- CVE-2025-57821 · NVD
- FIRST EPSS
- GHSA-7pwc-wh6m-44q3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences