Plataformatec Devise vulnerabilities

CVE-2013-0233 [MEDIUM] CWE-399 CVE-2013-0233: Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ru Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by

CVE-2019-5421 [CRITICAL] CWE-367 CVE-2019-5421: Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnera Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/models/lockable.rb that can result in Multiple concurrent requests can prevent an attacker from being blocked on br

CVE-2015-8314 [HIGH] CWE-288 Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie Devise version before 3.5.4 uses cookies to implement a "Remember me" functionality. However, it generates the same cookie for all devices. If an attacker manages to steal a remember me cookie and the user does not change the password frequently, the cookie can be used to gain access to the application indefinitely.

CVE-2026-32700 [MEDIUM] CWE-362 Devise has a confirmable "change email" race condition permits user to confirm email they have no access to Devise has a confirmable "change email" race condition permits user to confirm email they have no access to ### Impact A race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the `reconfirmable` option (the default when using Confirmable with email changes).

CVE-2026-40295 [MEDIUM] CWE-601 Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler ## Summary When the `Timeoutable` module is enabled in Devise, the `FailureApp#redirect_url` method returns `request.referrer` — the HTTP `Referer` header, which is attacker-controllable — without validation for any non-GET request that results in a session time

CVE-2019-16109 [MEDIUM] CVE-2019-16109: An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records would exist.)