TI-2026-29075 CVE-2026-40295 · GHSA-jp94-3292-c3xv
Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler
Priority LOW 27
Devise is an authentication solution for Rails based on Warden.
Vulnerabilities
3 records
TI-2026-25192 CVE-2026-32700 · GHSA-57hq-95w6-v4fc
Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to
Priority MEDIUM 60
Devise is an authentication solution for Rails based on Warden.
TI-2015-06843 CVE-2015-8314 · GHSA-746g-3gfp-hfhw
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which…
Priority MEDIUM 40
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.