CVE-2019-16109

CVE-2019-16109 describes a medium-severity vulnerability in Plataformatec Devise versions prior to 4.7.1, where an account could be confirmed if a blank confirmation_token was submitted and a corresponding blank value existed in the database. This issue is theoretical within Devise itself, as the framework does not generate such database records. The vulnerability has a CVSS score of 5.3, indicating a network-based attack with low complexity, resulting in a potential loss of confidentiality. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.