CVE-2020-8166 Ability to forge per-form CSRF tokens in Rails

Q: Which versions are affected by CVE-2020-8166?

4 open source packages ship an affected version, including actionpack. It affects 2 products.

Q: Is CVE-2020-8166 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-8166 exists.

Q: How do I fix CVE-2020-8166?

Upgrade actionpack to a fixed version for your release line: 5.2.4.3 or 6.0.3.1.

Medium 4.3 Published 2 Jul 2020 Updated 28 Apr 2026

Attackers can forge per-form CSRF tokens using a global token, bypassing CSRF protections in Ruby on Rails applications.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2020-8166?

CVE-2020-8166 is a medium-severity vulnerability in Debian Debian Linux, published on 2 Jul 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.

Weakness: CWE-352

Which versions are affected by CVE-2020-8166?

4 open source packages ship an affected version, including actionpack. It affects 2 products.

Package	Affected	Fixed in
`actionpack` RubyGems	From `5.0.0`	`5.2.4.3`
`actionpack` RubyGems	From `5.0.0`	`5.2.4.3`
`actionpack` RubyGems	From `6.0.0`	`6.0.3.1`
`actionpack` RubyGems	From `6.0.0`	`6.0.3.1`

Linux distribution packages (7)

`rubygem-actionpack-5_1` SUSE:Linux Enterprise High Availability Extension 15 SP1	All versions	`5.1.4-150000.3.29.1`
`rubygem-actionpack-5_1` SUSE:Linux Enterprise High Availability Extension 15 SP2	All versions	`5.1.4-150000.3.29.1`
`rubygem-actionpack-5_1` SUSE:Linux Enterprise High Availability Extension 15 SP3	All versions	`5.1.4-150000.3.29.1`
`rubygem-actionpack-5_1` SUSE:Linux Enterprise High Availability Extension 15 SP4	All versions	`5.1.4-150000.3.29.1`
`rubygem-actionpack-5_1` SUSE:Linux Enterprise High Availability Extension 15 SP5	All versions	`5.1.4-150000.3.29.1`
`rubygem-actionpack-5_1` openSUSE:Leap 15.4	All versions	`5.1.4-150000.3.29.1`
`rubygem-actionpack-5_1` openSUSE:Leap 15.5	All versions	`5.1.4-150000.3.29.1`

Products include Debian Debian Linux, Rubyonrails Rails.

How do I fix CVE-2020-8166?

Upgrade actionpack to a fixed version for your release line: 5.2.4.3 or 6.0.3.1.

Is CVE-2020-8166 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-8166 exists.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2020-8166, GHSA-jp5v-5gx4-jmj9, SUSE-SU-2024:0103-1, UBUNTU-CVE-2020-8166.