CVE-2026-39324: Rack Session Cookie Decoder Fallback Bypasses Encryptorscve-2026-39324-rack-session-cookie-decoder-fallback-bypasses-encryptors
Rack::Session::Cookie#unpacked_cookie_data falls back to an unauthenticated coder (e.g. Base64::Marshal) when configured encryptors fail to decrypt the cookie. Because encryptor failures are rescued and ignored, an attacker can forge a session cookie that fails authenticated decryption but is still parsed by the fallback coder, leading to authentication bypa
