CVE-2026-39324

CVE-2026-39324 is a critical authentication bypass vulnerability in Rack::Session::Cookie (versions 2.0.0 to 2.1.1) that allows attackers to forge valid session cookies by exploiting improper decryption failure handling. When cookie decryption fails, the vulnerable implementation falls back to a default decoder instead of rejecting the malformed cookie, enabling attackers to inject arbitrary session data without knowledge of the configured secret. The vulnerability carries a CVSS score of 9.8 CRITICAL with an unauthenticated, network-based attack vector requiring no user interaction or privileges. It presents high impact across confidentiality, integrity, and availability as attackers can manipulate session contents to gain unauthorized access and potentially compromise sensitive operations or data. This vulnerability is not currently listed on the Known Exploited Vulnerabilities catalog and shows minimal exploitation activity with an exceptionally low EPSS score of 0.00043. Patch 2.1.2 is available and organizations using affected Rack::Session versions should prioritize upgrading to remediate this critical authentication weakness.