Threats affecting pkg:gem/rack-session

CVE-2026-39324 is a critical improper authentication vulnerability in rack-session versions 2.0.0 up to but not including 2.1.2. The vulnerability arises because Rack::Session::Cookie incorrectly handles decryption failures by falling back to a default decoder instead of rejecting the cookie. This flaw allows an unauthenticated attacker to supply a crafted session cookie that is accepted as valid without knowing any configured secret, enabling manipulation of session contents and potential unauthorized access. The issue is fixed in version 2.1.2.