Authenticated email verification forgery via field desynchronization

Race condition in Devise before 5.0.3 allows remote authenticated users to confirm a victim's email on an attacker-controlled account. Confirmable omits a same-value unconfirmed_email from one concurrent SQL update while writing confirmation_token, desynchronizing the fields. The attack requires two concurrent email-change requests and reconfirmable, the default for Confirmable email changes; it creates a false verified-email binding without directly disclosing data or interrupting service.