CVE-2021-41263

rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications using `rails_multisite` alongside Rails' signed/encrypted cookies. Depending on how the application makes use of these cookies, it may be possible for an attacker to re-use cookies on different 'sites' within a multi-site Rails application. The issue has been patched in v4 of the `rails_multisite` gem. Note that this upgrade will invalidate all previous signed/encrypted cookies. The impact of this invalidation will vary based on the application architecture.

• CWE-200
• CWE-565
• CWE-327

• https://github.com/discourse/rails_multisite/commit/c6785cdb5c9277dd2c5ac8d55180dd1ece440ed0Patch, Third Party Advisory
• https://github.com/discourse/rails_multisite/security/advisories/GHSA-844m-cpr9-jcmhThird Party Advisory
• https://github.com/discourse/rails_multisite/commit/c6785cdb5c9277dd2c5ac8d55180dd1ece440ed0Patch, Third Party Advisory
• https://github.com/discourse/rails_multisite/security/advisories/GHSA-844m-cpr9-jcmhThird Party Advisory

Published

Nov 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41258Kirby is an open source file structured CMS. In affected ver…5.4
• CVE-2021-41259Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-4126When receiving an OpenPGP/MIME signed email message that con…6.5
• CVE-2021-41260Galette is a membership management web application built for…8.8
• CVE-2021-41261Galette is a membership management web application built for…4.8
• CVE-2021-41262Galette is a membership management web application built for…8.8
• CVE-2021-41264OpenZeppelin Contracts is a library for smart contract devel…9.8
• CVE-2021-41265Flask-AppBuilder is a development framework built on top of …8.8
• CVE-2021-41266Minio console is a graphical user interface for the for MinI…9.8
• CVE-2021-41267Symfony/Http-Kernel is the HTTP kernel component for Symfony…6.5
• CVE-2021-41268Symfony/SecurityBundle is the security system for Symfony, a…8.8
• CVE-2021-41269cron-utils is a Java library to define, parse, validate, mig…9.8