CVE-2025-57821: Basecamp Google Sign-In Auth Bypass Flaw

CVE-2025-57821 Overview

CVE-2025-57821 is an open redirect vulnerability [CWE-601] in Basecamp's google_sign_in gem, which adds Google sign-in capability to Ruby on Rails applications. Versions prior to 1.3.0 accept a malformed URL that passes the library's same-origin check, allowing an attacker to redirect an authenticated user to an attacker-controlled origin after the sign-in flow.

The issue is exploitable on its own for phishing-style redirects. Rails applications that store flash data in a session cookie may face a broader impact when the flaw is chained with a separate attack that injects arbitrary data into the session cookie.

Critical Impact
Attackers can craft a malformed redirect target that bypasses the same-origin check in RedirectProtector, sending users to an external origin after Google-based authentication.

Affected Products

Basecamp google_sign_in gem versions prior to 1.3.0
Ruby on Rails applications integrating google_sign_in for Google OAuth sign-in
Rails applications configured to store flash data in the session cookie (chained impact)

Discovery Timeline

2025-08-27 - CVE-2025-57821 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57821

Vulnerability Analysis

The google_sign_in gem uses a RedirectProtector class to ensure that post-authentication redirects stay within the same origin as the requesting application. The ensure_same_origin method checks whether a target URL matches a qualified URL pattern and, if so, compares its origin against the source request origin.

The original logic only rejected targets that matched the qualified URL pattern with a differing origin. Malformed URLs that did not match QUALIFIED_URL_PATTERN bypassed the check entirely and were treated as safe, permitting redirects to arbitrary external origins. The URL pattern is anchored using URI::DEFAULT_PARSER.make_regexp, and inputs that fail to fully match this pattern were not compared against the source origin at all.

When a Rails application stores flash data in the session cookie and an attacker can inject data into that cookie through a separate flaw, the redirect flaw can be chained to deliver a full session-context attack after the user authenticates with Google.

Root Cause

The root cause is inverted validation logic in lib/google_sign_in/redirect_protector.rb. The method raised a Violation only when the target matched a fully qualified URL with a different origin. Targets that were neither fully qualified URLs nor valid absolute paths were silently accepted, producing the open redirect condition.

Attack Vector

Exploitation requires user interaction and a network-reachable Rails endpoint that uses google_sign_in. An attacker crafts a link containing a malformed redirect_to-style parameter that evades QUALIFIED_URL_PATTERN yet is honored by the browser during navigation. The victim clicks the link, completes Google sign-in, and is redirected to the attacker-controlled origin.

ruby

    QUALIFIED_URL_PATTERN = /\A#{URI::DEFAULT_PARSER.make_regexp}\z/

    def ensure_same_origin(target, source)
-      if target.blank? || (target =~ QUALIFIED_URL_PATTERN && origin_of(target) != origin_of(source))
-        raise Violation, "Redirect target #{target.inspect} does not have same origin as request (expected #{origin_of(source)})"
+      if (target =~ QUALIFIED_URL_PATTERN && origin_of(target) == origin_of(source)) ||
+         target =~ URI::DEFAULT_PARSER.regexp[:ABS_PATH]
+        return
      end
+
+      raise Violation, "Redirect target #{target.inspect} does not have same origin as request (expected #{origin_of(source)})"
    end

    private

Source: GitHub Commit 8590365. The patch inverts the logic: only fully qualified same-origin URLs or valid absolute paths are allowed; everything else raises a Violation.

Detection Methods for CVE-2025-57821

Indicators of Compromise

Requests to google_sign_in callback routes containing unusual, encoded, or malformed redirect_uri/proceed parameters that do not match the application origin.
HTTP 302 responses from Rails endpoints redirecting to external hosts immediately after a Google sign-in callback.
Referer headers on downstream requests showing the application's Google sign-in callback followed by navigation to an unrelated domain.

Detection Strategies

Inspect application logs for requests to sign-in callback endpoints where the redirect target parameter is not a plain absolute path (/...) or a same-origin absolute URL.
Compare the Host header of authenticated Rails requests to the Location header of subsequent redirects; flag mismatches originating from google_sign_in routes.
Run dependency scanning against Gemfile.lock to identify google_sign_in versions below 1.3.0.

Monitoring Recommendations

Add continuous software composition analysis (SCA) to CI pipelines to alert on outdated google_sign_in versions.
Monitor authentication logs for redirect anomalies and correlate them with session cookie modifications indicative of chained attacks.
Alert on outbound redirects from sign-in flows that resolve to newly registered or low-reputation domains.

How to Mitigate CVE-2025-57821

Immediate Actions Required

Upgrade the google_sign_in gem to version 1.3.0 or later and redeploy affected Rails applications.
Audit Rails session configuration and switch flash storage away from cookie-based sessions where feasible.
Review recent authentication logs for suspicious redirects from Google sign-in callbacks.

Patch Information

The fix is included in google_sign_in v1.3.0. The patched ensure_same_origin method in lib/google_sign_in/redirect_protector.rb explicitly allow-lists fully qualified same-origin URLs and valid absolute paths, and raises Violation for everything else. Refer to the GitHub Security Advisory GHSA-7pwc-wh6m-44q3, Pull Request #73, and the v1.3.0 release notes for full details.

Workarounds

If upgrading is not immediately possible, set SameSite=Lax or SameSite=Strict on the application session cookie to break the chained cookie-injection attack path.
Enforce strict server-side allow-lists for post-sign-in redirect targets, rejecting anything that is not a same-origin absolute path.
Move flash storage out of the session cookie by configuring an alternative session store (for example, ActiveRecord or Redis-backed sessions).

bash

# Rails session cookie hardening (config/initializers/session_store.rb)
Rails.application.config.session_store :cookie_store,
  key: '_app_session',
  secure: Rails.env.production?,
  httponly: true,
  same_site: :lax

# Update the gem in Gemfile and lock file
# Gemfile
# gem 'google_sign_in', '>= 1.3.0'
bundle update google_sign_in