Devise CVE-2026-40295

The Timeoutable module must be explicitly enabled in the Devise configuration (typically via devise :timeoutable, timeout_in: X.minutes in the User model). The attack requires a non-GET HTTP request (POST, PUT, DELETE, PATCH) to trigger the timeout path; GET requests use the protected attempted_path mechanism and are not vulnerable. The victim's session must be expired at the time of the request. The attack requires user interaction (UI:R per CVSS) to visit the attacker-controlled page or click a link, but this is a standard phishing prerequisite. The browser must transmit a Referer header (standard browser behavior, but can be suppressed by attacker page configuration to their advantage or omitted by user settings, though most users send it). No special network position, authentication, or non-default configuration is required beyond enabling Timeoutable, which is a common feature in production deployments.

CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates network-exploitable vulnerability with low attack complexity and required user interaction (clicking a link or visiting attacker page), affecting confidentiality and integrity via credential theft or social engineering. The attack vector is network-based but requires initial user action (UI:R), which moderately constrains exploitation. Scope change (S:C) reflects that the vulnerability impacts confidentiality and integrity beyond the vulnerable application itself (victims redirected to external sites). No EPSS score, KEV status, or POC availability data provided; however, the vulnerability is straightforward to exploit (AC:L) and requires no authentication (PR:N), making it attractive for phishing campaigns once publicly disclosed. The attack surface is limited to environments where the Timeoutable module is explicitly enabled and sessions can expire, but such configurations are common in production Devise deployments. Real-world risk is amplified because the redirect occurs through a trusted domain (bypassing URL bar inspection), increasing victim click-through rates. The existence of a protected parallel code path (GET timeout using attempted_path) demonstrates that the development team recognized the risk in one context but failed to apply the same protection to POST/PUT/DELETE timeouts, suggesting this is a regression rather than inherent design flaw.

An attacker registers a domain and creates a webpage with hidden HTML containing an auto-submitting form (POST request) targeting the victim's Devise-protected application. The form includes a Referer header pointing to the attacker's credential-harvesting server. When a victim with an expired session visits the attacker's page, the form auto-submits, triggering a session timeout in the target application. The vulnerable redirect_url method reads the attacker-controlled Referer header and redirects the victim to the fake login page via the legitimate application domain (e.g., redirect from vulnerable-app.com to attacker-phishing.com). The victim, seeing the application domain in the browser URL bar during the redirect, trusts the destination and enters credentials, which the attacker harvests.