GHSA-5629-8855-gf4g
Authentication Bypass by CSRF Weakness
Impact
The actual vulnerability has been discovered on solidus_auth_devise. See GHSA-xm34-v85h-9pg2 for details.
The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update solidus_auth_devise. For this reason, it has been marked as low impact on this end.
Patches
For extra security, update solidus_core to versions 3.1.3, 3.0.3 or 2.11.12.
Workarounds
Look at the workarounds described at GHSA-xm34-v85h-9pg2.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in solidus_auth_devise or a discussion in solidus
- Email us at security@solidus.io
- Contact the core team on Slack
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
What each source reports
GitHub Advisories Score used
Authentication Bypass by CSRF Weakness
Impact
The actual vulnerability has been discovered on solidus_auth_devise. See GHSA-xm34-v85h-9pg2 for details.
The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update solidus_auth_devise. For this reason, it has been marked as low impact on this end.
Patches
For extra security, update solidus_core to versions 3.1.3, 3.0.3 or 2.11.12.
Workarounds
Look at the workarounds described at GHSA-xm34-v85h-9pg2.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in solidus_auth_devise or a discussion in solidus
- Email us at security@solidus.io
- Contact the core team on Slack
- Record
GHSA-5629-8855-gf4g- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-305, CWE-352
- Updated
- 2026-11-02
OSV
Authentication Bypass by CSRF Weakness
Impact
The actual vulnerability has been discovered on solidus_auth_devise. See GHSA-xm34-v85h-9pg2 for details.
The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update solidus_auth_devise. For this reason, it has been marked as low impact on this end.
Patches
For extra security, update solidus_core to versions 3.1.3, 3.0.3 or 2.11.12.
Workarounds
Look at the workarounds described at GHSA-xm34-v85h-9pg2.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in solidus_auth_devise or a discussion in solidus
- Email us at security@solidus.io
- Contact the core team on Slack
- Record
GHSA-5629-8855-gf4g- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-305, CWE-352
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
solidus_coreRubyGems | before 2.11.12 | 2.11.12 |
solidus_coreRubyGems | 3.0.0 up to 3.0.3 | 3.0.3 |
solidus_coreRubyGems | 3.1.0 up to 3.1.3 | 3.1.3 |
solidus_coreRubyGems | before 2.11.12, plus listed versions 1.0.01.0.0.pre1.0.0.pre21.0.0.pre31.0.0.rc1 Show 45 moreShow less1.0.0.rc21.0.11.0.21.0.31.0.41.0.51.0.61.0.71.1.01.1.0.beta11.1.0.pre11.1.0.pre21.1.11.1.21.1.31.1.41.2.01.2.0.beta11.2.0.rc11.2.0.rc21.2.11.2.21.2.31.3.01.3.0.beta11.3.0.rc11.3.0.rc21.3.11.3.21.4.01.4.0.beta11.4.0.rc11.4.11.4.22.0.02.0.0.beta12.0.0.rc12.0.12.0.22.0.32.1.02.1.0.beta12.1.0.rc12.1.12.10.0 | 2.11.12 |
solidus_coreRubyGems | 3.0.0 up to 3.0.3, plus listed versions 3.0.13.0.2 | 3.0.3 |
solidus_coreRubyGems | 3.1.0 up to 3.1.3, plus listed versions 3.1.13.1.2 | 3.1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-5629-8855-gf4g is a critical vulnerability (CVSS 9.3) in solidus_core, published November 18, 2021. No source lists public exploit code. Fixed in solidus_core 2.11.12.
References
Left out here: 67 versions. The JSON record has them.