Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout.
CVSS 3.1MEDIUM 4.8·Network·No auth·No interaction·EPSS 0.00283·Published 2026-01-20·Fixed in 8.0.21CWE-362