Access token security vulnerability
The package omniauth-facebook supports passing an access token directly in the URL. Because of that, an attacker may be able to authenticate as another user by passing a valid access token obtained from Facebook for another app.