A race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. By sending two concurrent email change requests, the attacker can desynchronize the confirmation_token and unconfirmed_email fields. The confirmation token is delivered to the attacker's mailbox while the unconfirmed_email in the database points to a victim’s address. When the attacker uses the token, the victim’s email is confirmed on the attacker’s account, enabling unauthorized account use.

All Ruby on Rails applications using the Devise authentication framework before version 5.0.3 with the Confirmable module enabled and the default reconfirmable option. The affected package is the heartcombo:devise library shipped as a Ruby Gem.

The vulnerability has a CVSS score of 6 and an EPSS score below 1 %, indicating moderate severity but low probability of exploitation. It is not listed in CISA’s KEV catalog. The attack requires creating two simultaneous email change requests, typically from distinct accounts or timing the requests closely; therefore, the most likely attack surface is the web interface that allows users to change their email. Successful exploitation results in the attacker confirming an email they control on an account that belongs to a victim, potentially enabling further intrusion.