CVE-2026-40295: Devise Open Redirect Vulnerability in Timeoutable Session Timeout Handler

Background

Devise is a flexible authentication solution for Rails based on Warden. It provides various modules to handle user authentication, including the Timeoutable module, which allows sessions to expire after a period of inactivity. This functionality is crucial for maintaining security in web applications, but it also introduces potential vulnerabilities if not properly managed.

Vulnerability Detail

The vulnerability arises from the Timeoutable module in Devise, where the FailureApp#redirect_url method returns the request.referrer without validation for non-GET requests that result in a session timeout. This allows an attacker to exploit the HTTP Referer header, redirecting users with expired sessions to arbitrary external URLs. The implications include phishing attacks, where users could be redirected to fake login pages, or malicious sites that could compromise user data. The vulnerability is particularly concerning because it bypasses browser phishing warnings, as the redirect appears to originate from a trusted domain.

gem install devise -v 5.0.4

Workaround

If an immediate upgrade is not possible, a temporary workaround involves applying a monkey patch in a Rails initializer. You can override the redirect_url method in Devise::FailureApp to sanitize the request.referrer. Here’s an example of how to implement the monkey patch:

# config/initializers/devise_monkey_patch.rb
module Devise
  class FailureApp
    def redirect_url
      if warden_message == :timeout
        flash[:timedout] = true if is_flashing_format?
        path = if request.get?
          attempted_path
        else
          extract_path_from_location(request.referrer) # Sanitize referrer
        end
        path || scope_url
      else
        scope_url
      end
    end
  end
end

Conclusion

The CVE-2026-40295 vulnerability in the Devise authentication library poses a significant risk due to its potential for exploitation via session timeouts. Users are strongly advised to upgrade to version 5.0.4 or later to mitigate this risk. In the interim, a monkey patch can be applied as a temporary solution.

See every vulnerability recorded for devise →

FAQ