--- title: GHSA-57hq-95w6-v4fc (devise): Confirmable "change email"... description: A race condition vulnerability (GHSA-57hq-95w6-v4fc) in Devise's Confirmable module allows an attacker to confirm an email address they don't own. By sending... canonical: https://daily.dev/posts/ghsa-57hq-95w6-v4fc-devise-confirmable-change-email-race-condition-permits-user-to-confirm-emai-xuuvn4m4d twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GHSA-57hq-95w6-v4fc (devise): Confirmable "change email" race condition permits user to confirm email they have no access to | daily.dev og:description: A race condition vulnerability (GHSA-57hq-95w6-v4fc) in Devise's Confirmable module allows an attacker to confirm an email address they don't own. By sending... og:url: https://daily.dev/posts/ghsa-57hq-95w6-v4fc-devise-confirmable-change-email-race-condition-permits-user-to-confirm-emai-xuuvn4m4d og:image: https://api.daily.dev/og/posts/xUUVN4M4D.png og:image:alt: GHSA-57hq-95w6-v4fc (devise): Confirmable "change email" race condition permits user to confirm email they have no access to og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GHSA-57hq-95w6-v4fc (devise): Confirmable "change email" race condition permits user to confirm email they have no access to **[RUBYLAND](https://daily.dev/sources/rubyla)** · 1 min read · 0 upvotes · 0 comments ## Summary A race condition vulnerability (GHSA-57hq-95w6-v4fc) in Devise's Confirmable module allows an attacker to confirm an email address they don't own. By sending two concurrent email change requests, the confirmation_token and unconfirmed_email fields become desynchronized — the token goes to the attacker's email, but the database records the victim's email. When the attacker uses the token, the victim's email gets confirmed on the attacker's account. The fix is available in Devise v5.0.3. A workaround exists by overriding postpone_email_change_until_confirmation_and_regenerate_confirmation_token to force unconfirmed_email persistence. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Build scanner-safe double opt-in](https://daily.dev/posts/build-scanner-safe-double-opt-in-qgdlkj42f) · Flavio Copes · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#ruby](https://daily.dev/tags/ruby) [View this post on daily.dev](https://daily.dev/posts/ghsa-57hq-95w6-v4fc-devise-confirmable-change-email-race-condition-permits-user-to-confirm-emai-xuuvn4m4d) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GHSA-57hq-95w6-v4fc (devise): Confirmable \"change email\" race condition permits user to confirm email they have no access to","url":"https://daily.dev/posts/ghsa-57hq-95w6-v4fc-devise-confirmable-change-email-race-condition-permits-user-to-confirm-emai-xuuvn4m4d","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghsa-57hq-95w6-v4fc-devise-confirmable-change-email-race-condition-permits-user-to-confirm-emai-xuuvn4m4d"},"datePublished":"2026-03-18T05:22:05.867Z","dateModified":"2026-03-18T05:22:23.491Z","description":"A race condition vulnerability (GHSA-57hq-95w6-v4fc) in Devise's Confirmable module allows an attacker to confirm an email address they don't own. By sending...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghsa-57hq-95w6-v4fc-devise-confirmable-change-email-race-condition-permits-user-to-confirm-emai-xuuvn4m4d","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,ruby","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"GHSA-57hq-95w6-v4fc (devise): Confirmable \"change email\" race condition permits user to confirm email they have no access to"}]} ```