CVE-2015-8314: Devise Gem for Ruby Unauthorized Access Using Remember Me Cookie
Summary
CVE-2015-8314: Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie. Affects devise versions < 3.5.4. Fixed in 3.5.4. How to fix ↓
Also tracked for
- ruby-devise · Debian:11
The same CVE-2015-8314 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Devise is a RubyGem that provides flexible authentication solutions for Rails applications. It offers features like user authentication, password encryption, and session management. However, versions before 3.5.4 of Devise have a vulnerability related to the implementation of the 'Remember me' functionality. This vulnerability allows an attacker to gain unauthorized access to the application by stealing a remember me cookie and using it indefinitely. The cookie generated by Devise is the same for all devices, making it easier for an attacker to exploit this vulnerability if the user does not frequently change their password.
Vulnerability Detail
The vulnerability in Devise arises from the generation of a single remember me cookie for all devices. If an attacker manages to steal this cookie, they can use it to gain unauthorized access to the application indefinitely. This can lead to various security risks, such as unauthorized data access, privilege escalation, and potential compromise of sensitive information. It is important to note that this vulnerability primarily affects Devise versions prior to 3.5.4.
How To Fix
Latest published version: 5.0.4 as of 22 Oct 2026
gem install devise -v 5.0.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.4
This is the first release that contains the fix.
gem install devise -v 3.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually delete their remember me cookies after each session to minimize the risk of unauthorized access. This can be done by clearing browser cookies or using browser extensions that manage and delete cookies. However, this workaround is not recommended as it relies on user diligence and may not provide complete protection against the vulnerability.
Conclusion
The vulnerability in Devise versions prior to 3.5.4 allows unauthorized access to the application using a stolen remember me cookie. To mitigate this risk, it is crucial to upgrade to Devise version 3.5.4 or later. Developers should promptly update their Gemfile and install the latest version of Devise. Users should also be encouraged to change their passwords regularly to invalidate any stolen remember me cookies. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for devise →
FAQ
Devise is a RubyGem that provides authentication solutions for Rails applications. It simplifies the implementation of user authentication, password encryption, and session management.
The vulnerability allows an attacker to gain unauthorized access to the application by stealing a remember me cookie. This can lead to various security risks, such as unauthorized data access, privilege escalation, and potential compromise of sensitive information.
Versions of Devise prior to 3.5.4 are affected by this vulnerability. It is recommended to upgrade to version 3.5.4 or later to mitigate the risk.
The recommended fix is to upgrade to Devise version 3.5.4 or later. This version generates unique remember me cookies for each device, reducing the risk of unauthorized access.
A workaround is to manually delete remember me cookies after each session. However, this workaround is not foolproof and may not provide complete protection against the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for devise.
