Persistent session access via reusable authentication cookies

Authentication bypass in Devise before 3.5.4 allows remote attackers with a stolen persistent cookie to gain persistent application access. The Rememberable model serializes one reusable token per account without a cookie creation timestamp, causing the same credential to be accepted across devices without per-cookie expiration. Exploitation requires theft of a user’s signed cookie; the attacker can then resume that user’s session indefinitely while the password remains unchanged.