Authentication Bypass Vulnerability in Devise by Heartcombo

CVE-2026-40295

What is CVE-2026-40295?

In certain versions of Devise, an authentication solution for Rails, the Timeoutable module's implementation is susceptible to a vulnerability that allows unauthorized redirection. Specifically, in versions 5.0.3 and below, the system fails to validate the HTTP Referer header when redirecting users following session timeouts. This oversight enables attackers to leverage auto-submitting cross-origin forms to redirect users with expired sessions to arbitrary URLs, leading to potential phishing attacks and malware distribution. Although the GET timeout path employs protections, the non-GET timeout redirect lacks similar security measures. This vulnerability undermines the trust of users who may then be misled into entering sensitive information on malicious sites due to the absence of protective warnings. The issue has been addressed in version 5.0.4.

References