6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40295

CVE-2026-40295: Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler

Devise is an authentication solution for Rails based on Warden. In versions 5.0.3 and below, when the Timeoutable module is enabled in Devise, the FailureApp#redirect_url method returns request.referrer — the HTTP Referer header, which is attacker-controllable — without validation for any non-GET request that results in a session timeout. An attacker who hosts a page with an auto-submitting cross-origin form can cause a victim with an expired Devise session to be redirected to an arbitrary external URL. This contrasts with the GET timeout path (which uses server-side attempted_path) and Devise's own store_location_for mechanism (which strips external hosts via extract_path_from_location), both of which are protected; only the non-GET timeout redirect path is unprotected. Expired-session users can be silently redirected from the trusted app domain to attacker-controlled URLs, enabling phishing and malware delivery while bypassing browser warnings. Note: Rails' built-in open-redirect protection does not mitigate this issue. Devise::FailureApp is an ActionController::Metal app with its own isolated copy of the relevant redirect configuration, so config.action_controller.action_on_open_redirect = :raise (and the older raise_on_open_redirects setting) do not reach it. This issue has been fixed in version 5.0.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40295

CVE-2026-40295:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
devise	rubygems	<= 5.0.3	5.0.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an open redirect within the Devise authentication library, specifically in the Timeoutable module that handles session timeouts. The root cause, identified from the patch commit 025fe2124f9928766fc46520e999633b598d0360, lies in the Devise::FailureApp.redirect_url function. For non-GET requests that time out, this function used the raw, unsanitized request.referrer value to determine the redirect destination. The HTTP Referer header is attacker-controllable. An attacker could create a malicious page that submits a form (e.g., a POST request) to the target application. If the victim's session has expired, the application would redirect them to the URL specified in the Referer header, which could be a phishing site.

The patch addresses this by wrapping request.referrer with the extract_path_from_location method. This sanitizes the input by stripping any scheme and host, ensuring that the redirect target is always a local path within the application, thereby mitigating the open redirect risk. The Devise::FailureApp.redirect function is also identified as a key runtime indicator, as it is the function that invokes redirect_url and executes the unsafe redirect.

Vulnerable functions

Devise::FailureApp.redirect_url

lib/devise/failure_app.rb

This function was vulnerable because it directly used the `request.referrer` (the HTTP Referer header) to determine the redirect URL for non-GET requests after a session timeout. Since the Referer header is controllable by an attacker, it could be set to a malicious external URL, causing an open redirect.

Devise::FailureApp.redirect

lib/devise/failure_app.rb

This function calls the vulnerable `redirect_url` method and uses its return value to perform the actual redirection via `redirect_to`. During an exploit, this function would be on the stack trace as it executes the unsafe redirect.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.