{"action":"Upgrade spree_auth_devise to 4.0.1 or later.","affected":[{"fixed":"4.4.1","introduced":"4.3.0"},{"fixed":"4.2.1","introduced":"4.2.0"},{"fixed":"4.1.1","introduced":"4.1.0"},{"fixed":"4.0.1","introduced":"0"}],"component":"spree_auth_devise","cve_ids":["CVE-2021-41275"],"ecosystem":"RubyGems","epss":0.00646,"exploited":false,"fixed_versions":["4.4.1","4.2.1","4.1.1","4.0.1"],"ghsa_id":"GHSA-26xx-m4q2-xhq8","id":"tcs_01M5KEFTJS0AHPMH9771TQSVXD","modified_at":"2026-07-08T06:29:30.052441152Z","published_at":"2021-11-18T20:14:19Z","references":["https://osv.dev/vulnerability/GHSA-26xx-m4q2-xhq8","https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2","https://github.com/spree/spree_auth_devise/security/advisories/GHSA-26xx-m4q2-xhq8","https://github.com/spree/spree_auth_devise/security/advisories/GHSA-6mqr-q86q-6gwr","https://github.com/spree/spree_auth_devise/security/advisories/GHSA-8xfw-5q82-3652","https://github.com/spree/spree_auth_devise/security/advisories/GHSA-gpqc-4pp7-5954","https://nvd.nist.gov/vuln/detail/CVE-2021-41275","https://github.com/spree/spree_auth_devise/commit/adf6ed4cd94d66091776b5febd4ff3767362de63","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_auth_devise/CVE-2021-41275.yml","https://github.com/spree/spree_auth_devise"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-26xx-m4q2-xhq8","url":"https://osv.dev/vulnerability/GHSA-26xx-m4q2-xhq8"}],"summary":"Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness"}