CVE-2021-41274: Authentication Bypass by CSRF Weakness

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-17 · updated 2026-06-17
Weakness: CWE-352

Description

solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). Users should promptly update to `solidus_auth_devise` version `2.5.4`. Users unable to update should if possible, change their strategy to `:exception`. Please see the linked GHSA for more workaround details.

Affected products

solidusio solidus_auth_devise: from 1.0.0 before 2.5.4 — fixed in 2.5.4

How to fix

Upgrade to a fixed version: solidusio solidus_auth_devise 2.5.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-41274 or the next vulnerability affects your stack