Executive brief
Devise, a popular authentication library for Ruby on Rails applications, contains a vulnerability that can be used to redirect users to malicious websites. When a user's session expires during a form submission, the application may automatically send them to a URL specified by an attacker rather than the intended login page. This can be used in phishing campaigns to trick users into entering their credentials on a fake website that looks like the legitimate application.
Technical details
An open redirect vulnerability exists in Devise's `FailureApp#redirect_url` method when the `Timeoutable` module is enabled. For non-GET requests (such as POST) that trigger a session timeout, the application uses the attacker-controllable HTTP `Referer` header to determine the redirect destination without proper validation. While GET requests are protected by server-side path tracking and other mechanisms sanitize URLs by stripping hostnames, this specific code path lacks those protections. An attacker can exploit this by hosting a page with an auto-submitting cross-origin form; if a victim with an expired session interacts with it, they are redirected to an arbitrary URL. This bypasses Rails' built-in open-redirect protection because `Devise::FailureApp` operates as an isolated `ActionController::Metal` application. The issue is fixed in version 5.0.4.
Affected products
- heartcombo devise <= 5.0.3
Timeline
- 2026-05-08: advisory
- 2026-05-08: patched