ACTIONPACK · GHSA-gmj8-hvj3-49mw · Package
FIX → 8.1.4.1 +1
Action Pack session stores other than CookieStore write the session cookie without a SameSite attribute, ignoring the configured cookies_same_site_protection default of :lax. In browsers that do not default such cookies to Lax, a cross-site request could carry the session cookie and enable cross-site request forgery against actions that skip authenticity token checks.
first public Nov 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications running Action Pack that use a session store other than ActionDispatch::Session::CookieStore and do not pass same_site: to config.session_store. Applications that use the default cookie store are not affected by this flaw.
Not affected if cookie-store, same-site-option-set
Who cares actionpack, api-only, rails, ruby, self-hosted
bundle exec rails -v or in Gemfile.lock for actionpack below 8.1.4.1 or below 8.0.5.2config.session_store and confirm whether it uses :cache_store, :mem_cache_store or a third-party store without a optionAction Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications.
Applications are affected when they use a session store other than CookieStore and do not pass same_site: to .
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
same_site:Upgrade to 8.1.4.1 +1
8.1.4.18.0.5.2same_site: to config.session_store, for example config.session_store :cache_store, same_site: :laxconfig.session_storeIn the fixed releases, every session store sets the session cookie's SameSite attribute from cookies_same_site_protection when its options have no :same_site key. An explicit same_site: option, including same_site: nil, and a :same_site value in a store's DEFAULT_OPTIONS still take precedence.
Pass same_site: when configuring the session store, for example config.session_store :cache_store, same_site: :lax.
The fixed releases are available at the normal locations.
Patches for those who cannot upgrade at once:
This issue was responsibly reported by HackerOne researcher tjvc.