CVE-2019-16109

Devise is a flexible authentication solution for Rails [1]. The vulnerability in the Confirmable module incorrectly verifies account confirmation: if the stored confirmation_token is blank, a request with a blank confirmation_token parameter will confirm the account without proper validation [2][3].

Attackers can exploit this by sending a request to the confirmation endpoint with an empty confirmation_token. The prerequisite is that a user record has a blank confirmation_token column, which is unlikely under normal Devise operation but could occur via custom code or direct database manipulation [2][3].

Successful exploitation allows an attacker to confirm an account without authorization, potentially gaining access to an account that was not fully confirmed [2].

The issue is patched in Devise 4.7.1. The fix ensures that a blank confirmation_token always returns an error [3]. For applications that already have users with a blank confirmation_token in the database, it is recommended to manually regenerate or nullify those tokens [3][4].