CVE-2026-40295: Devise Rails Auth Bypass Vulnerability

CVE-2026-40295 Overview

CVE-2026-40295 is an open redirect vulnerability in Devise, an authentication solution for Ruby on Rails based on Warden. The flaw affects versions 5.0.3 and below when the Timeoutable module is enabled. The FailureApp#redirect_url method returns request.referrer without validation for non-GET requests that trigger a session timeout. Attackers can craft cross-origin auto-submitting forms that redirect victims with expired sessions to arbitrary external URLs. The issue is classified as CWE-601 Open Redirect.

Critical Impact
Expired-session users can be silently redirected from a trusted application domain to attacker-controlled URLs, enabling phishing and malware delivery while bypassing browser warnings.

Affected Products

Devise authentication library for Ruby on Rails, versions 5.0.3 and below
Rails applications using Devise with the Timeoutable module enabled
Devise FailureApp component handling non-GET session timeout redirects

Discovery Timeline

2026-05-22 - CVE-2026-40295 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-40295

Vulnerability Analysis

The vulnerability resides in Devise's FailureApp class, which handles authentication failures including session timeouts. When the Timeoutable module detects an expired session on a non-GET request, FailureApp#redirect_url returns the value of request.referrer. The Referer HTTP header is controlled by the requesting client, including cross-origin pages. Devise does not validate this value against the application's host before issuing the redirect.

This behavior differs from the GET timeout path, which uses the server-side attempted_path variable. It also differs from Devise's store_location_for mechanism, which strips external hosts through extract_path_from_location. Only the non-GET timeout redirect path lacks host validation.

Root Cause

The root cause is missing validation of an attacker-controllable input. request.referrer reflects the HTTP Referer header, which any cross-origin page can set by hosting a form that submits to the target application. Devise's FailureApp trusts this value as a safe redirect target without confirming it points to the same origin.

Rails' built-in open-redirect protection does not mitigate this issue. Devise::FailureApp inherits from ActionController::Metal and maintains its own isolated copy of the relevant redirect configuration. Settings such as config.action_controller.action_on_open_redirect = :raise and the older raise_on_open_redirects setting do not reach this controller.

Attack Vector

An attacker hosts a page containing an auto-submitting form that targets a non-GET endpoint on the vulnerable Rails application. When a victim with an expired Devise session visits the attacker page, the browser submits the form with a Referer header pointing to the attacker domain. Devise detects the session timeout, invokes FailureApp, and issues an HTTP redirect to the attacker-controlled URL. The redirect originates from the trusted application origin, defeating user trust signals and browser-side phishing protections.

The vulnerability mechanism is documented in the GitHub Security Advisory GHSA-jp94-3292-c3xv and the remediation commit.

Detection Methods for CVE-2026-40295

Indicators of Compromise

HTTP 302 responses from Devise authentication endpoints containing Location headers pointing to external domains
Non-GET requests to authenticated routes carrying Referer headers from untrusted origins followed by redirects off-domain
Spikes in session timeout failure events correlated with cross-origin form submissions

Detection Strategies

Inspect web server and reverse proxy logs for redirect responses where the Location host differs from the application host
Add application-layer logging in FailureApp to record the resolved redirect_url value alongside the request path and method
Correlate authentication failure events with referrer values originating outside the application's allowed domains

Monitoring Recommendations

Alert on outbound redirects from authentication endpoints to domains not in an allow list
Track session timeout rates by HTTP method and flag anomalous volumes of non-GET timeouts originating from external referrers
Review browser security telemetry for users following redirects from the application domain to known phishing or malware hosts

How to Mitigate CVE-2026-40295

Immediate Actions Required

Upgrade Devise to version 5.0.4 or later, where the non-GET timeout redirect path validates the redirect target
Audit application code for additional use of request.referrer in redirects and replace with server-side path tracking
Review web server configuration to drop or sanitize unexpected Referer headers on authenticated non-GET endpoints

Patch Information

The issue is fixed in Devise version 5.0.4. The remediation is implemented in commit 025fe2124f9928766fc46520e999633b598d0360 on the heartcombo/devise repository. Application maintainers should update their Gemfile constraint and run bundle update devise.

Workarounds

Disable the Timeoutable module if the application's threat model permits, removing the vulnerable code path
Override Devise::FailureApp#redirect_url in the application to strip external hosts or fall back to a known-safe path for non-GET requests
Configure a reverse proxy or middleware to reject redirects whose Location host does not match the application's allow list

bash

# Update Devise to the patched release
bundle update devise --conservative
# Confirm the installed version
bundle show devise | grep -E 'devise-5\.0\.[4-9]'