5 known security vulnerabilities

  • highGHSA-746g-3gfp-hfhw(CVE-2015-8314)

    Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie

Show 4 more vulnerabilities
4 moderate
  • moderateGHSA-57hq-95w6-v4fc(CVE-2026-32700)

    Devise has a confirmable "change email" race condition permits user to confirm email they have no access to

  • moderateGHSA-73rf-6mrf-759q(CVE-2019-5421)

    devise Time-of-check Time-of-use Race Condition vulnerability

  • moderateGHSA-fcjw-8rhj-gwwc(CVE-2019-16109)

    Authentication Bypass in Devise

  • moderateGHSA-jp94-3292-c3xv(CVE-2026-40295)

    Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler

Flexible authentication solution for Rails with Warden

Required Ruby Version

None

Authors

José Valim, Carlos Antônio

Versions

  1. 5.0.4

    1. source

      1. 5.0.4 source May 08, 2026 (86 KB)
  2. 5.0.3

    1. source

      1. 5.0.3 source March 16, 2026 (85.5 KB)
  3. 5.0.2

    1. source

      1. 5.0.2 source February 18, 2026 (85 KB)
  4. 5.0.1

    1. source

      1. 5.0.1 source February 13, 2026 (85 KB)
  5. 5.0.0

    1. source

      1. 5.0.0 source January 23, 2026 (85 KB)
  6. 1.3.2

    1. source

      1. 1.3.2 source April 21, 2011 (104 KB)
Show all versions (180 total)

SHA 256 checksum

← Previous version Next version →