-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| devise | rubygems | < 3.5.4 | 3.5.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues: 1) Static cookie generation (same value across devices) due to missing timestamp in serialize_into_cookie, and 2) Server-side validation in serialize_from_cookie that didn't account for individual cookie creation time. The commit diff shows these functions were modified to add timestamp storage/validation (Time.now.utc in serialize_into_cookie and generated_at checks in serialize_from_cookie), directly addressing the infinite validity period problem. The CWE-288 (auth bypass) manifests through missing time-bound validation, while CWE-312 relates to insufficient protection of the persistent auth token.
RubyRubyOngoing coverage of React2Shell