CVE-2021-41274

solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). Users should promptly update to `solidus_auth_devise` version `2.5.4`. Users unable to update should if possible, change their strategy to `:exception`. Please see the linked GHSA for more workaround details.

• CWE-352

• https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555Patch, Third Party Advisory
• https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2Exploit, Third Party Advisory
• https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555Patch, Third Party Advisory
• https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2Exploit, Third Party Advisory

Published

Nov 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41269cron-utils is a Java library to define, parse, validate, mig…9.8
• CVE-2021-4127An out of date graphics library (Angle) likely contained vul…9.8
• CVE-2021-41270Symfony/Serializer handles serializing and deserializing dat…6.5
• CVE-2021-41271Discourse is a platform for community discussion. In affecte…5.3
• CVE-2021-41272Besu is an Ethereum client written in Java. Starting in vers…7.5
• CVE-2021-41273Pterodactyl is an open-source game server management panel b…4.3
• CVE-2021-41275spree_auth_devise is an open source library which provides a…8.8
• CVE-2021-41276Tuleap is a Libre and Open Source tool for end to end tracea…7.2
• CVE-2021-41277Metabase is an open source data analytics platform. In affec…7.5
• CVE-2021-41278Functions SDK for EdgeX is meant to provide all the plumbing…5.7
• CVE-2021-41279BaserCMS is an open source content management system with a …8.8
• CVE-2021-4128When transitioning in and out of fullscreen mode, a graphics…6.5