heartcombo/devise Security Advisories | GitStock

medium2026-05-08

Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler

GHSA-jp94-3292-c3xv · CVE-2026-40295

medium2026-03-17

Devise has a confirmable "change email" race condition permits user to confirm email they have no access to

GHSA-57hq-95w6-v4fc · CVE-2026-32700

high2023-01-26

Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie

GHSA-746g-3gfp-hfhw · CVE-2015-8314