AIKIDO-2026-603611
solidus_auth_devise is vulnerable to Account Enumeration
53
Medium Risk
This Affects:
solidus_auth_deviseTL;DR
The /password/recover and /admin/password/recover endpoints respond differently depending on whether the submitted email matches an existing account, even when Devise's paranoid mode is enabled. This lets anyone probe either endpoint to learn which email addresses have store or admin accounts, defeating the paranoid mode protection against account enumeration. The fix uses Devise's successfully_sent? check in both controllers so the response is uniform regardless of whether the account exists.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you have enabled Devise's paranoid mode (config.paranoid = true).
Background info
solidus_auth_devise is vulnerable to Account Enumeration in versions 0.0.1 - 2.6.0.
How to fix this
Upgrade the solidus_auth_devise library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.