In Devise versions prior to 5.0.4 with the Timeoutable module enabled, the FailureApp#redirect_url method uses the attacker-controllable HTTP Referer header for non-GET requests after session timeout without validation, enabling open redirect attacks. This bypasses Rails' built-in open-redirect protections because Devise::FailureApp operates with isolated redirect configuration. The vulnerability allows redirection of users with expired sessions to attacker-controlled external URLs, increasing risk of phishing and malware delivery. The issue is resolved in version 5.0.4.

An attacker can cause users with expired sessions to be redirected silently from the trusted application domain to arbitrary external URLs controlled by the attacker. This can facilitate phishing attacks or malware distribution by bypassing browser warnings related to redirects. The confidentiality and integrity impact is low, as the vulnerability does not grant direct access to data or system control, but it can lead to user deception and indirect compromise.

Upgrade Devise to version 5.0.4 or later, where this open redirect vulnerability is fixed. Until upgrading, be aware that the non-GET timeout redirect path is unprotected and can be exploited. No other official or temporary fixes are documented. Patch status is not explicitly stated in the vendor advisory, but the fix is included in version 5.0.4.