CVE-2019-5421

Vulnerability

A race condition exists in Devise::Models::Lockable#increment_failed_attempts in Devise versions 4.5.0 and earlier [1][2]. The method reads the failed_attempts value from the database and then increments it in two separate steps, rather than atomically. This allows concurrent requests to both read the same initial value and overwrite each other's increments, failing to correctly track failed login attempts. The vulnerability is classified as CWE-367 (Time-of-check Time-of-use race condition).

Exploitation

An attacker with network connectivity can perform a brute-force password attack by sending multiple authentication requests concurrently (e.g., using a multithreaded client) [2][3][4]. The race window is triggered when two or more requests reach the increment_failed_attempts method before any of them has written the updated count back to the database, causing the counter to increment by fewer than the total number of failed attempts. No authentication or special privileges are required to initiate the attack.

Impact

A successful exploitation allows the attacker to indefinitely bypass the account lockout mechanism designed to prevent brute-force password guessing [2][4]. The failed_attempts counter may never reach the configured limit, meaning the account remains unlocked even after many repeated failed login attempts. This enables an unauthenticated attacker to continue brute-forcing credentials without triggering a lockout, increasing the risk of account compromise.

Mitigation

The vulnerability is fixed in Devise version 4.6.0 [2][3]. The fix replaces the non-atomic read-then-increment pattern with ActiveRecord's #increment! method, which performs a single atomic database operation [3][4]. Users should upgrade to Devise 4.6.0 or later. For users unable to upgrade immediately, a workaround involving a raw SQL update (as shown in the issue report [4]) may be applied, but this is database-specific and not officially supported. No KEV listing is associated with this CVE.