Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URI
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.
Summary
Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.1, it is possible to redirect a user to another origin if the "proceed_to" value in the session store is set to a protocol-relative URL. Normally the value of this URL is only written and read by the library or the calling application. However, it may be possible to set this session value from a malicious site with a form submission. Any Rails applications using the google_sign_in gem may be vulnerable, if this vector can be chained with another attack that is able to modify the OAuth2 request parameters. This issue has been patched in version 1.3.1. There are no workarounds.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| basecamp | google_sign_in | before 1.3.1 | 1.3.1 | Patch available | CNA |
| — | google_sign_in (RubyGems) | before 1.3.1 | 1.3.1 | Patch available | GHSA-5jch-xhw4-r43v |
- google_sign_in Vendorbasecamp Affected before 1.3.1 Fixed in 1.3.1 Patch available CNA
- google_sign_in (RubyGems) Vendor— Affected before 1.3.1 Fixed in 1.3.1 Patch available GHSA-5jch-xhw4-r43v
Remediation
- Fix · CNA google_sign_in (basecamp) Fixed in 1.3.1
- Fix · GHSA-5jch-xhw4-r43v google_sign_in (RubyGems) Fixed in 1.3.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-58067
- 2026-10-03 Alias added: GHSA-5jch-xhw4-r43v
References
Other 6
- https://github.com/basecamp/google_sign_in/security/advisories/GHSA-5jch-xhw4-r43v
- https://github.com/basecamp/google_sign_in/pull/75
- https://github.com/basecamp/google_sign_in/commit/e97aef4626b1bcbd2c6f01f7dd25f12ac855d4cc
- https://github.com/basecamp/google_sign_in/releases/tag/v1.3.1
- https://github.com/basecamp/google_sign_in
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/google_sign_in/CVE-2025-58067.yml
More basecamp vulnerabilities
- TI-2023-18436 Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1… CVSS 3.1HIGH 7.5
- TI-2024-29019 Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste CVSS 3.1MEDIUM 6.5
- TI-2024-36043 Trix vulnerable to Cross-site Scripting on copy & paste CVSS 4.0MEDIUM 5.1
- TI-2018-16075 easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in… CVSS 3.1MEDIUM 6.1
- TI-2024-22682 The Trix Editor Contains an Arbitrary Code Execution Vulnerability CVSS 3.1MEDIUM 5.4
- TI-2025-15570 Trix allows Cross-site Scripting via `javascript:` url in a link CVSS 3.1MEDIUM 5.3
Sources
- CVE-2025-58067 · CVE Program
- CVE-2025-58067 · NVD
- FIRST EPSS
- GHSA-5jch-xhw4-r43v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences