Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

heartcombo/devise

              main @ 372b295
            

108

Fixes

CVEs

CRITICAL

Peak severity

53.1%

Coverage

Highlights

Auth Bypass: 60 prior fixes. Scrutinize any change in this area.

lib/devise/models/confirmable.rb: most-fixed (13 issues). Treat as high-risk during review.

34 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Open Redirect: Unvalidated Referer header extraction during session timeouts for non-GET requests allows attackers to redirect expired-session users to arbitrary external domains. The fix enforces strict host validation on the referrer.

Auth Bypass: A concurrency race condition in email reconfirmation allows concurrent updates to desynchronize confirmation tokens and unconfirmed emails, letting unauthorized users take ownership of target email addresses.

Authentication Bypass: A failure to validate blank or nil tokens allowed attackers to bypass account confirmation criteria when the target records also had empty confirmation token fields.