Rack CVE-2026-39324

Rack::Session::Cookie versions 2.0.0 to before 2.1.2 configured with secrets parameter. Remote unauthenticated attacker supplies crafted session cookie. No victim interaction required. Default configurations using encrypted cookies are vulnerable.

This represents a critical authentication bypass with severe real-world risk despite absence of confirmed exploitation. The CVSS 4.0 vector shows maximum attack surface: network-accessible (AV:N), low complexity (AC:L), no prerequisites (AT:N), no authentication required (PR:N), and high impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H). EPSS data not provided, but the attack requires only the ability to send crafted cookies-no timing attacks, race conditions, or complex exploit chains. SSVC factors suggest high priority: the vulnerability is automatable (simple HTTP requests), has high technical impact (full session control), and affects a widely-deployed session management library in the Ruby ecosystem. The primary risk mitigation is narrow version range (2.0.0-2.1.1) and that exploitation requires the application to use secrets: configuration. However, this is a recommended security practice, meaning secure configurations are paradoxically vulnerable. The straightforward nature of the flaw and public disclosure create high exploitation probability once details are understood by attackers.

An attacker identifies a Ruby web application using Rack::Session::Cookie 2.0.x-2.1.1 with encrypted sessions by observing session cookie characteristics or framework fingerprinting. The attacker crafts a malicious session cookie with arbitrary session data (for example, setting user_id to an administrator account ID or privilege flags) encoded in a format matching the default decoder's expectations, deliberately omitting valid encryption. When the application attempts to decrypt this cookie, decryption fails but triggers the fallback to the unauthenticated decoder, loading the attacker's crafted session state. The attacker is now authenticated as the target user or with elevated privileges, enabling account takeover, data exfiltration, or administrative actions without ever possessing valid credentials or encryption secrets. No public exploit code identified at time of analysis, but the attack requires only HTTP client capabilities to send modified cookies.