Vulnerability in Heartcombo Devise
CVE-2026-32700
Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application usi…
Vulnerability class: Race Condition
EPSS: 0.000 (5.4th percentile) — read the EPSS interpretation.
Affected products
- Heartcombo Devise — versions < 5.0.3
Weakness classification (CWE)
References
- https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc (x_refsource_CONFIRM)
- https://github.com/heartcombo/devise/issues/5783 (x_refsource_MISC)
- https://github.com/heartcombo/devise/pull/5784 (x_refsource_MISC)
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.yml (x_refsource_MISC)