spree_auth_devise

Version	Released
`4.6.3` patch	Jun 12, 2024
`4.6.2` patch	Apr 23, 2024
`4.6.1` patch	Feb 27, 2024
`4.6.0` minor	Sep 20, 2023
`4.5.0` minor	Dec 01, 2022
`4.4.2` patch	Dec 03, 2021
`4.0.1` patch	Nov 17, 2021
`4.2.1` patch	Nov 17, 2021
`4.1.1` patch	Nov 17, 2021
`4.4.1` patch	Nov 17, 2021
`4.4.0` minor 1 CVE	Sep 14, 2021
`4.3.4` patch 1 CVE	Feb 24, 2021
`4.3.3` patch 1 CVE	Feb 04, 2021
`4.3.2` patch 1 CVE	Jan 25, 2021
`4.3.1` patch 1 CVE	Jan 16, 2021
`4.3.0` minor 1 CVE	Jan 14, 2021
`4.2.0` minor 1 CVE	Jul 16, 2020
`4.1.0` minor 1 CVE	Feb 20, 2020
`4.1.0.rc1` pre	Jan 30, 2020
`4.0.0` major 1 CVE	Sep 30, 2019
`4.0.0.rc2` pre 1 CVE	Sep 09, 2019
`4.0.0.rc1` pre 1 CVE	Aug 28, 2019
`3.5.2` patch 1 CVE	Jul 03, 2019
`3.5.1` patch 1 CVE	Apr 03, 2019
`3.5.0` minor 1 CVE	Jan 29, 2019
`3.4.2` patch 1 CVE	Oct 09, 2018
`3.4.1` patch 1 CVE	Sep 27, 2018
`3.4.0` minor 1 CVE	Sep 06, 2018
`3.3.3` patch 1 CVE	Mar 12, 2018
`3.3.1` patch 1 CVE	Aug 24, 2017
`3.3.0` minor 1 CVE	Jul 25, 2017
`3.3.0.rc1` pre 1 CVE	Jul 02, 2017
`3.2.0` minor 1 CVE	Jun 15, 2017
`3.2.0.beta` pre 1 CVE	Dec 06, 2016
`3.1.0` minor 1 CVE	Apr 07, 2016
`3.0.6` patch 1 CVE	Mar 16, 2016
`3.0.5` major 1 CVE	Feb 10, 2016
`1.3.1` minor 2 CVEs	Dec 26, 2012
`1.2.0` minor 2 CVEs	Dec 15, 2012
`1.0.1` patch 2 CVEs	Nov 22, 2012
`1.0.0` initial 2 CVEs	Nov 08, 2012

4.6.3 patch

Jun 12, 2024

4.6.2 patch

Apr 23, 2024

4.6.1 patch

Feb 27, 2024

4.6.0 minor

Sep 20, 2023

4.5.0 minor

Dec 01, 2022

4.4.2 patch

Dec 03, 2021

4.0.1 patch

Nov 17, 2021

4.2.1 patch

Nov 17, 2021

4.1.1 patch

Nov 17, 2021

4.4.1 patch

Nov 17, 2021

4.4.0 minor

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Sep 14, 2021

4.3.4 patch

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Feb 24, 2021

4.3.3 patch

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Feb 04, 2021

4.3.2 patch

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Jan 25, 2021

4.3.1 patch

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Jan 16, 2021

4.3.0 minor

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Jan 14, 2021

4.2.0 minor

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Jul 16, 2020

4.1.0 minor

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Feb 20, 2020

4.1.0.rc1 pre

Jan 30, 2020

4.0.0 major

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Sep 30, 2019

4.0.0.rc2 pre

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Sep 09, 2019

4.0.0.rc1 pre

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Aug 28, 2019

3.5.2 patch

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Jul 03, 2019

3.5.1 patch

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Apr 03, 2019

3.5.0 minor

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Jan 29, 2019

3.4.2 patch

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Oct 09, 2018

3.4.1 patch

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Sep 27, 2018

3.4.0 minor

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Sep 06, 2018

3.3.3 patch

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Mar 12, 2018

3.3.1 patch

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Aug 24, 2017

3.3.0 minor

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Jul 25, 2017

3.3.0.rc1 pre

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Jul 02, 2017

3.2.0 minor

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Jun 15, 2017

3.2.0.beta pre

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Dec 06, 2016

3.1.0 minor

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Apr 07, 2016

3.0.6 patch

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Mar 16, 2016

3.0.5 major

1 CVE

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Feb 10, 2016

1.3.1 minor

2 CVEs

CVE-2013-2506 GHSA-jp57-9j37-5476 May 17, 2022

spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles

Medium

app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.

Affected versions


          1.0.0


          1.0.1


          1.2.0


          1.3.1

Fixed in


          3.0.5

References

Updated Dec 07, 2024 · Source: OSV.dev

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Dec 26, 2012

1.2.0 minor

2 CVEs

CVE-2013-2506 GHSA-jp57-9j37-5476 May 17, 2022

spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles

Medium

app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.

Affected versions


          1.0.0


          1.0.1


          1.2.0


          1.3.1

Fixed in


          3.0.5

References

Updated Dec 07, 2024 · Source: OSV.dev

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Dec 15, 2012

1.0.1 patch

2 CVEs

CVE-2013-2506 GHSA-jp57-9j37-5476 May 17, 2022

spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles

Medium

app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.

Affected versions


          1.0.0


          1.0.1


          1.2.0


          1.3.1

Fixed in


          3.0.5

References

Updated Dec 07, 2024 · Source: OSV.dev

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Nov 22, 2012

1.0.0 initial

2 CVEs

CVE-2013-2506 GHSA-jp57-9j37-5476 May 17, 2022

spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles

Medium

app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.

Affected versions


          1.0.0


          1.0.1


          1.2.0


          1.3.1

Fixed in


          3.0.5

References

Updated Dec 07, 2024 · Source: OSV.dev

CVE-2021-41275 GHSA-26xx-m4q2-xhq8 Nov 18, 2021

Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

9.3 / 10

Critical

Network Low None Required Changed High High None

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A before_action callback (the default)
- A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 Spree 4.1 users should update to spree_auth_devise 4.1.1 Older Spree version users should update to spree_auth_devise 4.0.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rb to at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2

Affected versions


          4.3.0


          4.3.1


          4.3.2


          4.3.3


          4.3.4


          4.4.0


          4.2.0


          4.1.0


          1.0.0


          1.0.1


          1.2.0


          1.3.1

+ 18 more


            3.0.5


            3.0.6


            3.1.0


            3.2.0


            3.2.0.beta


            3.3.0


            3.3.0.rc1


            3.3.1


            3.3.3


            3.4.0


            3.4.1


            3.4.2


            3.5.0


            3.5.1


            3.5.2


            4.0.0


            4.0.0.rc1


            4.0.0.rc2

Fixed in


          4.0.1


          4.1.1


          4.2.1


          4.4.1

References

Updated Jul 08, 2026 · Source: OSV.dev

Nov 08, 2012

Activity

Details