Skip to content
OpenAdvisories

Product · heartcombo

devise

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-40295

    Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler

    Devise is an authentication solution for Rails based on Warden. In versions 5.0.3 and below, when the Timeoutable module is enabled in Devise, the FailureApp#redirect_url method returns request.referrer — the HTTP Referer header, which is attacker-controllabl…

    heartcombo devise devise ruby-devise Debian Ubuntu RubyGems
  • Medium 6.0
    CVE-2026-32700

    Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to

    Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the `reconfirmabl…

    heartcombo devise devise ruby-devise Debian Ubuntu RubyGems