In Devise 5.0.3 and older, the Timeoutable module turns an expired session into a redirect that uses the HTTP Referer header exactly as received. Because this header is supplied by the browser and can be crafted by an attacker, the redirect URL can point to any external site. The vulnerability only triggers for non-GET requests that result in a timeout. Unlike the GET-based redirect path, it does not filter or validate the target, making it a classic Open Redirect (CWE‑601). An attacker can host a page with an auto-submitting form to trick a logged-out user into being redirected to a phishing or malware site, bypassing browser warnings.

The flaw affects any Rails application that employs the heartcombo:devise authentication library version 5.0.3 or earlier with the Timeoutable module enabled. All users experiencing expired sessions in those deployments are potentially vulnerable.

The CVSS score of 6.1 indicates moderate severity, and the issue is not listed in CISA’s KEV catalog. Because the vulnerability requires an expired session and a non-GET request, an attacker would need to drive the victim to such a request—typically via a cross-origin form or controlled link. However, the attack can be executed purely through a web page, yielding phishing and malware delivery without requiring additional infrastructure. While exploitation probability is not quantified (EPSS unavailable), the potential for widespread phishing makes timely remediation advisable.