CVE-2026-32700

CVE-2026-32700 describes a race condition in Devise, an authentication solution for Rails, affecting versions prior to 5.0.3 when using the `reconfirmable` option. This vulnerability allows an attacker to confirm an email address they do not own by exploiting a desynchronization between confirmation tokens and unconfirmed email fields through concurrent requests. Rated as Medium severity (CVSS 5.3), it requires a network attack with high complexity but has a high integrity impact, enabling the attacker to confirm a victim's email on their own account. There is currently no evidence of active exploitation, public exploit code, or significant community discussion regarding this vulnerability. Users are strongly advised to upgrade Devise to version 5.0.3 or implement the provided workaround.