CVE-2026-32700

Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the `reconfirmable` option (the default when using Confirmable with email changes). By sending two concurrent email change requests, an attacker can desynchronize the `confirmation_token` and `unconfirmed_email` fields. The confirmation token is sent to an email the attacker controls, but the `unconfirmed_email` in the database points to a victim's email address. When the attacker uses the token, the victim's email is confirmed on the attacker's account. This is patched in Devise v5.0.3. Users should upgrade as soon as possible. As a workaround, applications can override a specific method from Devise models to force `unconfirmed_email` to be persisted when unchanged. Note that Mongoid does not seem to respect that `will_change!` should force the attribute to be persisted, even if it did not really change, so the user might have to implement a workaround similar to Devise by setting `changed_attributes["unconfirmed_email"] = nil` as well.

• CWE-362

• https://github.com/heartcombo/devise/issues/5783Issue Tracking
• https://github.com/heartcombo/devise/pull/5784Issue Tracking, Patch
• https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fcVendor Advisory
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/GHSA-57hq-95w6-v4fc.ymlBroken Link
• https://github.com/heartcombo/devise/issues/5783Issue Tracking

Published

Mar 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32695Traefik is an HTTP reverse proxy and load balancer. Prior to…7.7
• CVE-2026-32696NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …7.5
• CVE-2026-32697SuiteCRM is an open-source, enterprise-ready Customer Relati…6.5
• CVE-2026-32698OpenProject is an open-source, web-based project management …7.2
• CVE-2026-32699FacturaScripts is an open source accounting and invoicing so…5.3
• CVE-2026-3270A vulnerability has been found in psi-probe PSI Probe up to …8.8
• CVE-2026-32701Qwik is a performance-focused JavaScript framework. Versions…7.5
• CVE-2026-32702Cleanuparr is a tool for automating the cleanup of unwanted …5.3
• CVE-2026-32703OpenProject is an open-source, web-based project management …5.4
• CVE-2026-32704SiYuan is a personal knowledge management system. Prior to 3…6.5
• CVE-2026-32705PX4 autopilot is a flight control solution for drones. Prior…6.8
• CVE-2026-32706PX4 autopilot is a flight control solution for drones. Prior…8.1