CVE-2021-41274

RubyGems/solidus_auth_devise CVE-2021-41274: critical 9.3, EPSS 0.73%

Authentication Bypass by CSRF Weakness

Action: Upgrade solidus_auth_devise to 2.5.4 or later.

bundle update solidus_auth_devise

Affected

Fixed versions

Sources

• osv: GHSA-xm34-v85h-9pg2
• https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
• https://nvd.nist.gov/vuln/detail/CVE-2021-41274
• https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_auth_devise/CVE-2021-41274.yml
• https://github.com/solidusio/solidus_auth_devise
• https://github.com/solidusio/solidus_auth_devise/releases/tag/v2.5.4

CVE-2021-41274 · published 2021-11-18T20:09:32Z · modified 2026-07-08T06:29:18.249512784Z · JSON