{"action":"Upgrade solidus_auth_devise to 2.5.4 or later.","affected":[{"fixed":"2.5.4","introduced":"1.0.0"}],"component":"solidus_auth_devise","cve_ids":["CVE-2021-41274"],"ecosystem":"RubyGems","epss":0.00726,"exploited":false,"fixed_versions":["2.5.4"],"ghsa_id":"GHSA-xm34-v85h-9pg2","id":"tcs_01M5KEP9QP308975TT1NX029BA","modified_at":"2026-07-08T06:29:18.249512784Z","published_at":"2021-11-18T20:09:32Z","references":["https://osv.dev/vulnerability/GHSA-xm34-v85h-9pg2","https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2","https://nvd.nist.gov/vuln/detail/CVE-2021-41274","https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_auth_devise/CVE-2021-41274.yml","https://github.com/solidusio/solidus_auth_devise","https://github.com/solidusio/solidus_auth_devise/releases/tag/v2.5.4"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-xm34-v85h-9pg2","url":"https://osv.dev/vulnerability/GHSA-xm34-v85h-9pg2"}],"summary":"Authentication Bypass by CSRF Weakness"}