Rack::Session::Cookie incorrectly handles decryption failures when secrets are configured. When a cookie cannot be decrypted, the library falls back to a default decoder instead of rejecting it. This flaw lets an unauthenticated attacker craft a session cookie that is accepted as valid without knowing any configured secret. The attacker can then manipulate the session payload, potentially gaining unauthorized access to the application. Because the session payload is deserialized using Marshal, this vulnerability may also allow remote code execution if the application uses unsafe deserialization. The weakness corresponds to authentication bypass and deserialization flaws.

The issue affects Rack's session management component rack-session, versions from 2.0.0 up to, but not including, 2.1.2. Applications built with these Ruby libraries are vulnerable if they rely on cookie‑based sessions and have any configured secrets. The vulnerability is present in any deployment that does not upgrade past 2.1.2.

The CVSS base score is 9.3, indicating a critical severity. No EPSS score is reported, and the defect is not yet in CISA’s KEV catalog, but the lack of a secret requirement for exploitation makes the threat broad. An attacker only needs to send a malicious cookie to the target endpoint; no authentication or additional privileges are required. If exploited, the impact can range from unauthorized data access to possible code execution depending on how the application deserializes the session data.