Devise versions prior to 5.0.4, when using the Timeoutable module, improperly handle redirection after session timeout for non-GET requests by returning the HTTP Referer header directly without validation. This header can be controlled by attackers, enabling open redirect attacks that redirect users to untrusted external sites. The vulnerability bypasses Rails' built-in open redirect protections because Devise::FailureApp operates with isolated redirect configuration. This flaw can be exploited to redirect users silently from the trusted app domain to attacker-controlled URLs, increasing risks of phishing and malware delivery. The issue is resolved in Devise version 5.0.4.

An attacker can cause users with expired sessions to be redirected to arbitrary external URLs by exploiting the unvalidated use of the HTTP Referer header in non-GET request timeout redirects. This can facilitate phishing attacks or malware distribution by leveraging trusted domain redirects. The vulnerability does not impact the GET request timeout path or other Devise redirect mechanisms that properly validate redirect destinations. There is no indication of known exploits in the wild at this time.

Upgrade Devise to version 5.0.4 or later, where this open redirect vulnerability has been fixed. Until upgrading, be aware that the Timeoutable module's non-GET timeout redirect path is vulnerable to open redirect attacks. No other official or temporary fixes are documented. Patch status is not explicitly confirmed in the advisory, but the fix is included in version 5.0.4.