Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-86533 (GCVE-0-2026-86533)

Vulnerability from nvd – Published: 2026-09-17 13:09 – Updated: 2026-09-17 18:17

Title

Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

Summary

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working. This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 18:13 UTC

CWE

CWE-613 - Insufficient Session Expiration

Assigner

EEF mitre root

References

10 references

URL	Tags
https://github.com/team-alembic/ash_authenticatio…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-86533.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-86533	related
https://github.com/team-alembic/ash_authenticatio…	relatedvendor-advisory
https://github.com/team-alembic/ash_authenticatio…	related
https://github.com/team-alembic/ash_authenticatio…	patch
https://github.com/team-alembic/ash_authenticatio…	patch
https://github.com/team-alembic/ash_authenticatio…	related
https://github.com/team-alembic/ash_authenticatio…	related
https://github.com/team-alembic/ash_authenticatio…	patch

Impacted products

4 products

Vendor	Product	Version
team-alembic	ash_authentication	Affected: 4.9.1 , < 4.15.0 (semver) Affected: 5.0.0-rc.0 , < 5.0.0-rc.14 (semver) cpe:2.3:a:team-alembic:ash_authentication::::::::
team-alembic	ash_authentication	Affected: fcaeb73f76f8f2e9aef8bf637690d2a20dd97596 , < * (git) cpe:2.3:a:team-alembic:ash_authentication::::::::
team-alembic	ash_authentication_phoenix	Affected: 2.10.0 , < 2.17.4 (semver) Affected: 3.0.0-rc.0 , < 3.0.0-rc.11 (semver) cpe:2.3:a:team-alembic:ash_authentication_phoenix::::::::
team-alembic	ash_authentication_phoenix	Affected: a3253fb4fc7145aeb403537af1c24d3a8d51ffb1 , < * (git) Affected: 0135217e34e621dac79ae3d9559aeee49304b0aa , < * (git) cpe:2.3:a:team-alembic:ash_authentication_phoenix::::::::

Date Public

2026-09-17 13:09

Credits

Peter Ullrich Jonatan Männchen / EEF James Harton

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86533",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T18:13:50.422619Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T18:17:21.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Plug.Helpers\u0027"
          ],
          "packageName": "ash_authentication",
          "packageURL": "pkg:hex/ash_authentication",
          "product": "ash_authentication",
          "programFiles": [
            "lib/ash_authentication/plug/helpers.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Plug.Helpers\u0027:retrieve_from_session/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Plug.Helpers\u0027:authenticate_resource_from_session/4"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "4.15.0",
              "status": "affected",
              "version": "4.9.1",
              "versionType": "semver"
            },
            {
              "lessThan": "5.0.0-rc.14",
              "status": "affected",
              "version": "5.0.0-rc.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Plug.Helpers\u0027"
          ],
          "packageName": "team-alembic/ash_authentication",
          "packageURL": "pkg:github/team-alembic/ash_authentication",
          "product": "ash_authentication",
          "programFiles": [
            "lib/ash_authentication/plug/helpers.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Plug.Helpers\u0027:retrieve_from_session/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Plug.Helpers\u0027:authenticate_resource_from_session/4"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "changes": [
                {
                  "at": "a3f49f758f013d2ff086dd9c5ef2d94e921711b4",
                  "status": "unaffected"
                },
                {
                  "at": "e28e911caa9728d76329afdb0fb26742ffe4eeef",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "fcaeb73f76f8f2e9aef8bf637690d2a20dd97596",
              "versionType": "git"
            }
          ]
        },
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Phoenix.LiveSession\u0027"
          ],
          "packageName": "ash_authentication_phoenix",
          "packageURL": "pkg:hex/ash_authentication_phoenix",
          "product": "ash_authentication_phoenix",
          "programFiles": [
            "lib/ash_authentication_phoenix/live_session.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.LiveSession\u0027:on_mount/4"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication_phoenix",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "2.17.4",
              "status": "affected",
              "version": "2.10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.0-rc.11",
              "status": "affected",
              "version": "3.0.0-rc.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Phoenix.LiveSession\u0027"
          ],
          "packageName": "team-alembic/ash_authentication_phoenix",
          "packageURL": "pkg:github/team-alembic/ash_authentication_phoenix",
          "product": "ash_authentication_phoenix",
          "programFiles": [
            "lib/ash_authentication_phoenix/live_session.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.LiveSession\u0027:on_mount/4"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication_phoenix",
          "vendor": "team-alembic",
          "versions": [
            {
              "changes": [
                {
                  "at": "f7ab005a2aac09707a25521653c94893d328cc52",
                  "status": "unaffected"
                },
                {
                  "at": "0135217e34e621dac79ae3d9559aeee49304b0aa",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "a3253fb4fc7145aeb403537af1c24d3a8d51ffb1",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "f7ab005a2aac09707a25521653c94893d328cc52",
                  "status": "unaffected"
                },
                {
                  "at": "0135217e34e621dac79ae3d9559aeee49304b0aa",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "0135217e34e621dac79ae3d9559aeee49304b0aa",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.15.0",
                  "versionStartIncluding": "4.9.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.0.0-rc.14",
                  "versionStartIncluding": "5.0.0-rc.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.17.4",
                  "versionStartIncluding": "2.10.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.0.0-rc.11",
                  "versionStartIncluding": "3.0.0-rc.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "James Harton"
        }
      ],
      "dateAssigned": "2026-09-11T18:52:39.000Z",
      "datePublic": "2026-09-17T13:09:38.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.\u003c/p\u003e\n\u003cp\u003eA resource configured with \u003ccode\u003esession_identifier :jti\u003c/code\u003e and \u003ccode\u003erequire_token_presence_for_authentication?\u003c/code\u003e disabled stores its session value as \u003ccode\u003e\u0026lt;jti\u0026gt;:\u0026lt;subject\u0026gt;\u003c/code\u003e. The \u003ccode\u003ejti\u003c/code\u003e is there so that signing out can revoke that one session. Neither reader consults it: \u003ccode\u003eAshAuthentication.Plug.Helpers.authenticate_resource_from_session/4\u003c/code\u003e and \u003ccode\u003eAshAuthentication.Phoenix.LiveSession.on_mount/4\u003c/code\u003e both split the value with \u003ccode\u003esplit_identifier/2\u003c/code\u003e, discard the \u003ccode\u003ejti\u003c/code\u003e and pass the bare subject to \u003ccode\u003eAshAuthentication.subject_to_user/3\u003c/code\u003e, which reloads the record. The token-presence branch of each function does check its token, calling \u003ccode\u003eAshAuthentication.TokenResource.Actions.get_token/3\u003c/code\u003e with the \u003ccode\u003ejti\u003c/code\u003e and the purpose \u003ccode\u003euser\u003c/code\u003e. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.\n\nA resource configured with `session_identifier :jti` and `require_token_presence_for_authentication?` disabled stores its session value as `\u003cjti\u003e:\u003csubject\u003e`. The `jti` is there so that signing out can revoke that one session. Neither reader consults it: `AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4` and `AshAuthentication.Phoenix.LiveSession.on_mount/4` both split the value with `split_identifier/2`, discard the `jti` and pass the bare subject to `AshAuthentication.subject_to_user/3`, which reloads the record. The token-presence branch of each function does check its token, calling `AshAuthentication.TokenResource.Actions.get_token/3` with the `jti` and the purpose `user`. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.\n\nThis issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11."
            }
          ],
          "value": "Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.\n\nA resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as \u003cjti\u003e:\u003csubject\u003e. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.\n\nThis issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-60",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-60 Reusing Session IDs (aka Session Replay)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T14:05:29.472Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-m6x4-4gvp-xwjr"
        },
        {
          "name": "EEF CNA record for CVE-2026-86533",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-86533.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-86533",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-86533"
        },
        {
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-w374-hvrx-66hg"
        },
        {
          "name": "Introducing commit fcaeb73 in team-alembic/ash_authentication",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/fcaeb73f76f8f2e9aef8bf637690d2a20dd97596"
        },
        {
          "name": "Fix commit a3f49f7 in team-alembic/ash_authentication",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/a3f49f758f013d2ff086dd9c5ef2d94e921711b4"
        },
        {
          "name": "Fix commit e28e911 in team-alembic/ash_authentication",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/e28e911caa9728d76329afdb0fb26742ffe4eeef"
        },
        {
          "name": "Introducing commit a3253fb in team-alembic/ash_authentication_phoenix",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/a3253fb4fc7145aeb403537af1c24d3a8d51ffb1"
        },
        {
          "name": "Introducing commit 0135217 in team-alembic/ash_authentication_phoenix",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/0135217e34e621dac79ae3d9559aeee49304b0aa"
        },
        {
          "name": "Fix commit f7ab005 in team-alembic/ash_authentication_phoenix",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/f7ab005a2aac09707a25521653c94893d328cc52"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-86533",
    "datePublished": "2026-09-17T13:09:37.963Z",
    "dateReserved": "2026-09-11T18:00:02.036Z",
    "dateUpdated": "2026-09-17T18:17:21.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81632 (GCVE-0-2026-81632)

Vulnerability from nvd – Published: 2026-09-17 13:09 – Updated: 2026-09-17 18:29

Title

Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

Summary

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, AshAuthentication.Phoenix.Components.Password.SignInForm builds the sign_in_with_token path with the freshly issued user.__metadata__.token as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser's own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential. This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Severity

7.2 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 18:29 UTC

CWE

CWE-598 - Use of HTTP Request With Sensitive Query String

Assigner

EEF mitre root

References

10 references

URL	Tags
https://github.com/team-alembic/ash_authenticatio…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-81632.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-81632	related
https://github.com/team-alembic/ash_authenticatio…	vendor-advisoryrelated
https://github.com/team-alembic/ash_authenticatio…	related
https://github.com/team-alembic/ash_authenticatio…	patch
https://github.com/team-alembic/ash_authenticatio…	patch
https://github.com/team-alembic/ash_authenticatio…	related
https://github.com/team-alembic/ash_authenticatio…	patch
https://github.com/team-alembic/ash_authenticatio…	patch

Impacted products

4 products

Vendor	Product	Version
team-alembic	ash_authentication_phoenix	Affected: 1.7.0 , < 2.17.4 (semver) Affected: 3.0.0-rc.0 , < 3.0.0-rc.11 (semver) cpe:2.3:a:team-alembic:ash_authentication_phoenix::::::::
team-alembic	ash_authentication_phoenix	Affected: 903f3a386e1aba2f7b070187ef6f31215a92bdfd , < * (git) cpe:2.3:a:team-alembic:ash_authentication_phoenix::::::::
team-alembic	ash_authentication	Affected: 3.10.5 , < 4.15.0 (semver) Affected: 5.0.0-rc.0 , < 5.0.0-rc.14 (semver) cpe:2.3:a:team-alembic:ash_authentication::::::::
team-alembic	ash_authentication	Affected: eca8cadea0f1595ed2c10a0c177b1da9aa9e5269 , < * (git) cpe:2.3:a:team-alembic:ash_authentication::::::::

Credits

Peter Ullrich Jonatan Männchen / EEF James Harton

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81632",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T18:29:05.558007Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T18:29:20.271Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027"
          ],
          "packageName": "ash_authentication_phoenix",
          "packageURL": "pkg:hex/ash_authentication_phoenix",
          "product": "ash_authentication_phoenix",
          "programFiles": [
            "lib/ash_authentication_phoenix/components/password/sign_in_form.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027:get_redirect_path/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027:get_auth_path_params/2"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication_phoenix",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "2.17.4",
              "status": "affected",
              "version": "1.7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.0-rc.11",
              "status": "affected",
              "version": "3.0.0-rc.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027"
          ],
          "packageName": "team-alembic/ash_authentication_phoenix",
          "packageURL": "pkg:github/team-alembic/ash_authentication_phoenix",
          "product": "ash_authentication_phoenix",
          "programFiles": [
            "lib/ash_authentication_phoenix/components/password/sign_in_form.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027:get_redirect_path/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027:get_auth_path_params/2"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication_phoenix",
          "vendor": "team-alembic",
          "versions": [
            {
              "changes": [
                {
                  "at": "920257d0460b9c7cbb42a83d0888c10f4eeeb88a",
                  "status": "unaffected"
                },
                {
                  "at": "ff5ad8737748afed9cdfde3ec3a05b8a4702a742",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "903f3a386e1aba2f7b070187ef6f31215a92bdfd",
              "versionType": "git"
            }
          ]
        },
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "ash_authentication",
          "packageURL": "pkg:hex/ash_authentication",
          "product": "ash_authentication",
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "4.15.0",
              "status": "affected",
              "version": "3.10.5",
              "versionType": "semver"
            },
            {
              "lessThan": "5.0.0-rc.14",
              "status": "affected",
              "version": "5.0.0-rc.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "team-alembic/ash_authentication",
          "packageURL": "pkg:github/team-alembic/ash_authentication",
          "product": "ash_authentication",
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "changes": [
                {
                  "at": "bbf345c1bb7aa28bce5dd856ac0ed2427f103859",
                  "status": "unaffected"
                },
                {
                  "at": "8d8ddd25c69b669a92a701af74bff42e1aada998",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "eca8cadea0f1595ed2c10a0c177b1da9aa9e5269",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.17.4",
                  "versionStartIncluding": "1.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.0.0-rc.11",
                  "versionStartIncluding": "3.0.0-rc.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.15.0",
                  "versionStartIncluding": "3.10.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.0.0-rc.14",
                  "versionStartIncluding": "5.0.0-rc.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "James Harton"
        }
      ],
      "dateAssigned": "2026-09-11T18:51:56.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner.\u003c/p\u003e\n\u003cp\u003eAfter a successful password sign-in, \u003ccode\u003eAshAuthentication.Phoenix.Components.Password.SignInForm\u003c/code\u003e builds the \u003ccode\u003esign_in_with_token\u003c/code\u003e path with the freshly issued \u003ccode\u003euser.__metadata__.token\u003c/code\u003e as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser\u0027s own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner.\n\nAfter a successful password sign-in, `AshAuthentication.Phoenix.Components.Password.SignInForm` builds the `sign_in_with_token` path with the freshly issued `user.__metadata__.token` as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser\u0027s own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential.\n\nThis issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14."
            }
          ],
          "value": "Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner.\n\nAfter a successful password sign-in, AshAuthentication.Phoenix.Components.Password.SignInForm builds the sign_in_with_token path with the freshly issued user.__metadata__.token as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser\u0027s own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential.\n\nThis issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-150",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-150 Collect Data from Common Resource Locations"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "CWE-598 Use of HTTP Request With Sensitive Query String",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T13:09:31.601Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-8jh5-339h-mqx9"
        },
        {
          "name": "EEF CNA record for CVE-2026-81632",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-81632.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-81632",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-81632"
        },
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-j726-59hm-r46r"
        },
        {
          "name": "Introducing commit 903f3a3 in team-alembic/ash_authentication_phoenix",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/903f3a386e1aba2f7b070187ef6f31215a92bdfd"
        },
        {
          "name": "Fix commit 920257d in team-alembic/ash_authentication_phoenix",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/920257d0460b9c7cbb42a83d0888c10f4eeeb88a"
        },
        {
          "name": "Fix commit ff5ad87 in team-alembic/ash_authentication_phoenix",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/ff5ad8737748afed9cdfde3ec3a05b8a4702a742"
        },
        {
          "name": "Introducing commit eca8cad in team-alembic/ash_authentication",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/eca8cadea0f1595ed2c10a0c177b1da9aa9e5269"
        },
        {
          "name": "Fix commit bbf345c in team-alembic/ash_authentication",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/bbf345c1bb7aa28bce5dd856ac0ed2427f103859"
        },
        {
          "name": "Fix commit 8d8ddd2 in team-alembic/ash_authentication",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/8d8ddd25c69b669a92a701af74bff42e1aada998"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-81632",
    "datePublished": "2026-09-17T13:09:31.601Z",
    "dateReserved": "2026-09-11T18:45:01.476Z",
    "dateUpdated": "2026-09-17T18:29:20.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-4754 (GCVE-0-2025-4754)

Vulnerability from nvd – Published: 2025-06-17 14:31 – Updated: 2026-09-22 09:23

Title

Missing Session Revocation on Logout in ash_authentication_phoenix

Summary

Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it. This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-17 14:40 UTC

CWE

CWE-613 - Insufficient Session Expiration

Assigner

EEF mitre root

References

6 references

URL	Tags
https://github.com/team-alembic/ash_authenticatio…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2025-4754.html	related
https://osv.dev/vulnerability/EEF-CVE-2025-4754	related
https://github.com/team-alembic/ash_authenticatio…	patch
https://github.com/team-alembic/ash_authenticatio…	related
https://github.com/team-alembic/ash_authenticatio…	patch

Impacted products

2 products

Vendor	Product	Version
team-alembic	ash_authentication_phoenix	Affected: 0.1.0 , < 2.10.0 (semver) cpe:2.3:a:team-alembic:ash_authentication_phoenix::::::::
team-alembic	ash_authentication_phoenix	Affected: 05ab4f438bf0cd0fdfb279d912bbe0d2c3620e02 , < a3253fb4fc7145aeb403537af1c24d3a8d51ffb1 (git) cpe:2.3:a:team-alembic:ash_authentication_phoenix::::::::

Credits

James Harton Zach Daniel Mike Buhot Jonatan Männchen / EEF Josh Price / Alembic

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-4754",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-17T14:40:37.216297Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T14:41:09.297Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Phoenix.Controller\u0027"
          ],
          "packageName": "ash_authentication_phoenix",
          "packageURL": "pkg:hex/ash_authentication_phoenix",
          "product": "ash_authentication_phoenix",
          "programFiles": [
            "lib/ash_authentication_phoenix/controller.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Controller\u0027:\u0027__using__\u0027/1"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication_phoenix",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "2.10.0",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Phoenix.Controller\u0027"
          ],
          "packageName": "team-alembic/ash_authentication_phoenix",
          "packageURL": "pkg:github/team-alembic/ash_authentication_phoenix",
          "product": "ash_authentication_phoenix",
          "programFiles": [
            "lib/ash_authentication_phoenix/controller.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Controller\u0027:\u0027__using__\u0027/1"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication_phoenix",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "a3253fb4fc7145aeb403537af1c24d3a8d51ffb1",
              "status": "affected",
              "version": "05ab4f438bf0cd0fdfb279d912bbe0d2c3620e02",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.10.0",
                  "versionStartIncluding": "0.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "James Harton"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Mike Buhot"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Josh Price / Alembic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards.\u003c/p\u003e\n\u003cp\u003eThe default \u003ccode\u003esign_out/2\u003c/code\u003e that \u003ccode\u003eAshAuthentication.Phoenix.Controller\u003c/code\u003e injects into an application\u0027s auth controller only calls \u003ccode\u003ePlug.Conn.clear_session/1\u003c/code\u003e. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards.\n\nThe default `sign_out/2` that `AshAuthentication.Phoenix.Controller` injects into an application\u0027s auth controller only calls `Plug.Conn.clear_session/1`. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it.\n\nThis issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0."
            }
          ],
          "value": "Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards.\n\nThe default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application\u0027s auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it.\n\nThis issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-593",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-593 Session Hijacking"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T09:23:20.437Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-f7gq-h8jv-h3cq"
        },
        {
          "name": "EEF CNA record for CVE-2025-4754",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2025-4754.html"
        },
        {
          "name": "OSV record EEF-CVE-2025-4754",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2025-4754"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/pull/634"
        },
        {
          "name": "Introducing commit 05ab4f4 in team-alembic/ash_authentication_phoenix",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/05ab4f438bf0cd0fdfb279d912bbe0d2c3620e02"
        },
        {
          "name": "Fix commit a3253fb in team-alembic/ash_authentication_phoenix",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/a3253fb4fc7145aeb403537af1c24d3a8d51ffb1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing Session Revocation on Logout in ash_authentication_phoenix"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2025-4754",
    "datePublished": "2025-06-17T14:31:37.006Z",
    "dateReserved": "2025-05-15T09:03:11.355Z",
    "dateUpdated": "2026-09-22T09:23:20.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86533 (GCVE-0-2026-86533)

Vulnerability from cvelistv5 – Published: 2026-09-17 13:09 – Updated: 2026-09-17 18:17

Title

Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

Summary

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working. This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 18:13 UTC

CWE

CWE-613 - Insufficient Session Expiration

Assigner

EEF mitre root

References

10 references

URL	Tags
https://github.com/team-alembic/ash_authenticatio…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-86533.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-86533	related
https://github.com/team-alembic/ash_authenticatio…	relatedvendor-advisory
https://github.com/team-alembic/ash_authenticatio…	related
https://github.com/team-alembic/ash_authenticatio…	patch
https://github.com/team-alembic/ash_authenticatio…	patch
https://github.com/team-alembic/ash_authenticatio…	related
https://github.com/team-alembic/ash_authenticatio…	related
https://github.com/team-alembic/ash_authenticatio…	patch

Impacted products

4 products

Vendor	Product	Version
team-alembic	ash_authentication	Affected: 4.9.1 , < 4.15.0 (semver) Affected: 5.0.0-rc.0 , < 5.0.0-rc.14 (semver) cpe:2.3:a:team-alembic:ash_authentication::::::::
team-alembic	ash_authentication	Affected: fcaeb73f76f8f2e9aef8bf637690d2a20dd97596 , < * (git) cpe:2.3:a:team-alembic:ash_authentication::::::::
team-alembic	ash_authentication_phoenix	Affected: 2.10.0 , < 2.17.4 (semver) Affected: 3.0.0-rc.0 , < 3.0.0-rc.11 (semver) cpe:2.3:a:team-alembic:ash_authentication_phoenix::::::::
team-alembic	ash_authentication_phoenix	Affected: a3253fb4fc7145aeb403537af1c24d3a8d51ffb1 , < * (git) Affected: 0135217e34e621dac79ae3d9559aeee49304b0aa , < * (git) cpe:2.3:a:team-alembic:ash_authentication_phoenix::::::::

Date Public

2026-09-17 13:09

Credits

Peter Ullrich Jonatan Männchen / EEF James Harton

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86533",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T18:13:50.422619Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T18:17:21.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Plug.Helpers\u0027"
          ],
          "packageName": "ash_authentication",
          "packageURL": "pkg:hex/ash_authentication",
          "product": "ash_authentication",
          "programFiles": [
            "lib/ash_authentication/plug/helpers.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Plug.Helpers\u0027:retrieve_from_session/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Plug.Helpers\u0027:authenticate_resource_from_session/4"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "4.15.0",
              "status": "affected",
              "version": "4.9.1",
              "versionType": "semver"
            },
            {
              "lessThan": "5.0.0-rc.14",
              "status": "affected",
              "version": "5.0.0-rc.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Plug.Helpers\u0027"
          ],
          "packageName": "team-alembic/ash_authentication",
          "packageURL": "pkg:github/team-alembic/ash_authentication",
          "product": "ash_authentication",
          "programFiles": [
            "lib/ash_authentication/plug/helpers.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Plug.Helpers\u0027:retrieve_from_session/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Plug.Helpers\u0027:authenticate_resource_from_session/4"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "changes": [
                {
                  "at": "a3f49f758f013d2ff086dd9c5ef2d94e921711b4",
                  "status": "unaffected"
                },
                {
                  "at": "e28e911caa9728d76329afdb0fb26742ffe4eeef",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "fcaeb73f76f8f2e9aef8bf637690d2a20dd97596",
              "versionType": "git"
            }
          ]
        },
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Phoenix.LiveSession\u0027"
          ],
          "packageName": "ash_authentication_phoenix",
          "packageURL": "pkg:hex/ash_authentication_phoenix",
          "product": "ash_authentication_phoenix",
          "programFiles": [
            "lib/ash_authentication_phoenix/live_session.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.LiveSession\u0027:on_mount/4"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication_phoenix",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "2.17.4",
              "status": "affected",
              "version": "2.10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.0-rc.11",
              "status": "affected",
              "version": "3.0.0-rc.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Phoenix.LiveSession\u0027"
          ],
          "packageName": "team-alembic/ash_authentication_phoenix",
          "packageURL": "pkg:github/team-alembic/ash_authentication_phoenix",
          "product": "ash_authentication_phoenix",
          "programFiles": [
            "lib/ash_authentication_phoenix/live_session.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.LiveSession\u0027:on_mount/4"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication_phoenix",
          "vendor": "team-alembic",
          "versions": [
            {
              "changes": [
                {
                  "at": "f7ab005a2aac09707a25521653c94893d328cc52",
                  "status": "unaffected"
                },
                {
                  "at": "0135217e34e621dac79ae3d9559aeee49304b0aa",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "a3253fb4fc7145aeb403537af1c24d3a8d51ffb1",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "f7ab005a2aac09707a25521653c94893d328cc52",
                  "status": "unaffected"
                },
                {
                  "at": "0135217e34e621dac79ae3d9559aeee49304b0aa",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "0135217e34e621dac79ae3d9559aeee49304b0aa",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.15.0",
                  "versionStartIncluding": "4.9.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.0.0-rc.14",
                  "versionStartIncluding": "5.0.0-rc.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.17.4",
                  "versionStartIncluding": "2.10.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.0.0-rc.11",
                  "versionStartIncluding": "3.0.0-rc.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "James Harton"
        }
      ],
      "dateAssigned": "2026-09-11T18:52:39.000Z",
      "datePublic": "2026-09-17T13:09:38.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.\u003c/p\u003e\n\u003cp\u003eA resource configured with \u003ccode\u003esession_identifier :jti\u003c/code\u003e and \u003ccode\u003erequire_token_presence_for_authentication?\u003c/code\u003e disabled stores its session value as \u003ccode\u003e\u0026lt;jti\u0026gt;:\u0026lt;subject\u0026gt;\u003c/code\u003e. The \u003ccode\u003ejti\u003c/code\u003e is there so that signing out can revoke that one session. Neither reader consults it: \u003ccode\u003eAshAuthentication.Plug.Helpers.authenticate_resource_from_session/4\u003c/code\u003e and \u003ccode\u003eAshAuthentication.Phoenix.LiveSession.on_mount/4\u003c/code\u003e both split the value with \u003ccode\u003esplit_identifier/2\u003c/code\u003e, discard the \u003ccode\u003ejti\u003c/code\u003e and pass the bare subject to \u003ccode\u003eAshAuthentication.subject_to_user/3\u003c/code\u003e, which reloads the record. The token-presence branch of each function does check its token, calling \u003ccode\u003eAshAuthentication.TokenResource.Actions.get_token/3\u003c/code\u003e with the \u003ccode\u003ejti\u003c/code\u003e and the purpose \u003ccode\u003euser\u003c/code\u003e. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.\n\nA resource configured with `session_identifier :jti` and `require_token_presence_for_authentication?` disabled stores its session value as `\u003cjti\u003e:\u003csubject\u003e`. The `jti` is there so that signing out can revoke that one session. Neither reader consults it: `AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4` and `AshAuthentication.Phoenix.LiveSession.on_mount/4` both split the value with `split_identifier/2`, discard the `jti` and pass the bare subject to `AshAuthentication.subject_to_user/3`, which reloads the record. The token-presence branch of each function does check its token, calling `AshAuthentication.TokenResource.Actions.get_token/3` with the `jti` and the purpose `user`. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.\n\nThis issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11."
            }
          ],
          "value": "Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.\n\nA resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as \u003cjti\u003e:\u003csubject\u003e. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.\n\nThis issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-60",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-60 Reusing Session IDs (aka Session Replay)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T14:05:29.472Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-m6x4-4gvp-xwjr"
        },
        {
          "name": "EEF CNA record for CVE-2026-86533",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-86533.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-86533",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-86533"
        },
        {
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-w374-hvrx-66hg"
        },
        {
          "name": "Introducing commit fcaeb73 in team-alembic/ash_authentication",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/fcaeb73f76f8f2e9aef8bf637690d2a20dd97596"
        },
        {
          "name": "Fix commit a3f49f7 in team-alembic/ash_authentication",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/a3f49f758f013d2ff086dd9c5ef2d94e921711b4"
        },
        {
          "name": "Fix commit e28e911 in team-alembic/ash_authentication",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/e28e911caa9728d76329afdb0fb26742ffe4eeef"
        },
        {
          "name": "Introducing commit a3253fb in team-alembic/ash_authentication_phoenix",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/a3253fb4fc7145aeb403537af1c24d3a8d51ffb1"
        },
        {
          "name": "Introducing commit 0135217 in team-alembic/ash_authentication_phoenix",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/0135217e34e621dac79ae3d9559aeee49304b0aa"
        },
        {
          "name": "Fix commit f7ab005 in team-alembic/ash_authentication_phoenix",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/f7ab005a2aac09707a25521653c94893d328cc52"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-86533",
    "datePublished": "2026-09-17T13:09:37.963Z",
    "dateReserved": "2026-09-11T18:00:02.036Z",
    "dateUpdated": "2026-09-17T18:17:21.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81632 (GCVE-0-2026-81632)

Vulnerability from cvelistv5 – Published: 2026-09-17 13:09 – Updated: 2026-09-17 18:29

Title

Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

Summary

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, AshAuthentication.Phoenix.Components.Password.SignInForm builds the sign_in_with_token path with the freshly issued user.__metadata__.token as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser's own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential. This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Severity

7.2 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 18:29 UTC

CWE

CWE-598 - Use of HTTP Request With Sensitive Query String

Assigner

EEF mitre root

References

10 references

URL	Tags
https://github.com/team-alembic/ash_authenticatio…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-81632.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-81632	related
https://github.com/team-alembic/ash_authenticatio…	vendor-advisoryrelated
https://github.com/team-alembic/ash_authenticatio…	related
https://github.com/team-alembic/ash_authenticatio…	patch
https://github.com/team-alembic/ash_authenticatio…	patch
https://github.com/team-alembic/ash_authenticatio…	related
https://github.com/team-alembic/ash_authenticatio…	patch
https://github.com/team-alembic/ash_authenticatio…	patch

Impacted products

4 products

Vendor	Product	Version
team-alembic	ash_authentication_phoenix	Affected: 1.7.0 , < 2.17.4 (semver) Affected: 3.0.0-rc.0 , < 3.0.0-rc.11 (semver) cpe:2.3:a:team-alembic:ash_authentication_phoenix::::::::
team-alembic	ash_authentication_phoenix	Affected: 903f3a386e1aba2f7b070187ef6f31215a92bdfd , < * (git) cpe:2.3:a:team-alembic:ash_authentication_phoenix::::::::
team-alembic	ash_authentication	Affected: 3.10.5 , < 4.15.0 (semver) Affected: 5.0.0-rc.0 , < 5.0.0-rc.14 (semver) cpe:2.3:a:team-alembic:ash_authentication::::::::
team-alembic	ash_authentication	Affected: eca8cadea0f1595ed2c10a0c177b1da9aa9e5269 , < * (git) cpe:2.3:a:team-alembic:ash_authentication::::::::

Credits

Peter Ullrich Jonatan Männchen / EEF James Harton

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81632",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T18:29:05.558007Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T18:29:20.271Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027"
          ],
          "packageName": "ash_authentication_phoenix",
          "packageURL": "pkg:hex/ash_authentication_phoenix",
          "product": "ash_authentication_phoenix",
          "programFiles": [
            "lib/ash_authentication_phoenix/components/password/sign_in_form.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027:get_redirect_path/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027:get_auth_path_params/2"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication_phoenix",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "2.17.4",
              "status": "affected",
              "version": "1.7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.0-rc.11",
              "status": "affected",
              "version": "3.0.0-rc.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027"
          ],
          "packageName": "team-alembic/ash_authentication_phoenix",
          "packageURL": "pkg:github/team-alembic/ash_authentication_phoenix",
          "product": "ash_authentication_phoenix",
          "programFiles": [
            "lib/ash_authentication_phoenix/components/password/sign_in_form.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027:get_redirect_path/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Components.Password.SignInForm\u0027:get_auth_path_params/2"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication_phoenix",
          "vendor": "team-alembic",
          "versions": [
            {
              "changes": [
                {
                  "at": "920257d0460b9c7cbb42a83d0888c10f4eeeb88a",
                  "status": "unaffected"
                },
                {
                  "at": "ff5ad8737748afed9cdfde3ec3a05b8a4702a742",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "903f3a386e1aba2f7b070187ef6f31215a92bdfd",
              "versionType": "git"
            }
          ]
        },
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "ash_authentication",
          "packageURL": "pkg:hex/ash_authentication",
          "product": "ash_authentication",
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "4.15.0",
              "status": "affected",
              "version": "3.10.5",
              "versionType": "semver"
            },
            {
              "lessThan": "5.0.0-rc.14",
              "status": "affected",
              "version": "5.0.0-rc.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "team-alembic/ash_authentication",
          "packageURL": "pkg:github/team-alembic/ash_authentication",
          "product": "ash_authentication",
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "changes": [
                {
                  "at": "bbf345c1bb7aa28bce5dd856ac0ed2427f103859",
                  "status": "unaffected"
                },
                {
                  "at": "8d8ddd25c69b669a92a701af74bff42e1aada998",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "eca8cadea0f1595ed2c10a0c177b1da9aa9e5269",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.17.4",
                  "versionStartIncluding": "1.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.0.0-rc.11",
                  "versionStartIncluding": "3.0.0-rc.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.15.0",
                  "versionStartIncluding": "3.10.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.0.0-rc.14",
                  "versionStartIncluding": "5.0.0-rc.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "James Harton"
        }
      ],
      "dateAssigned": "2026-09-11T18:51:56.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner.\u003c/p\u003e\n\u003cp\u003eAfter a successful password sign-in, \u003ccode\u003eAshAuthentication.Phoenix.Components.Password.SignInForm\u003c/code\u003e builds the \u003ccode\u003esign_in_with_token\u003c/code\u003e path with the freshly issued \u003ccode\u003euser.__metadata__.token\u003c/code\u003e as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser\u0027s own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner.\n\nAfter a successful password sign-in, `AshAuthentication.Phoenix.Components.Password.SignInForm` builds the `sign_in_with_token` path with the freshly issued `user.__metadata__.token` as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser\u0027s own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential.\n\nThis issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14."
            }
          ],
          "value": "Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner.\n\nAfter a successful password sign-in, AshAuthentication.Phoenix.Components.Password.SignInForm builds the sign_in_with_token path with the freshly issued user.__metadata__.token as a query parameter and redirects the browser to it with a GET. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser\u0027s own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential.\n\nThis issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-150",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-150 Collect Data from Common Resource Locations"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "CWE-598 Use of HTTP Request With Sensitive Query String",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T13:09:31.601Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-8jh5-339h-mqx9"
        },
        {
          "name": "EEF CNA record for CVE-2026-81632",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-81632.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-81632",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-81632"
        },
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-j726-59hm-r46r"
        },
        {
          "name": "Introducing commit 903f3a3 in team-alembic/ash_authentication_phoenix",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/903f3a386e1aba2f7b070187ef6f31215a92bdfd"
        },
        {
          "name": "Fix commit 920257d in team-alembic/ash_authentication_phoenix",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/920257d0460b9c7cbb42a83d0888c10f4eeeb88a"
        },
        {
          "name": "Fix commit ff5ad87 in team-alembic/ash_authentication_phoenix",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/ff5ad8737748afed9cdfde3ec3a05b8a4702a742"
        },
        {
          "name": "Introducing commit eca8cad in team-alembic/ash_authentication",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/eca8cadea0f1595ed2c10a0c177b1da9aa9e5269"
        },
        {
          "name": "Fix commit bbf345c in team-alembic/ash_authentication",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/bbf345c1bb7aa28bce5dd856ac0ed2427f103859"
        },
        {
          "name": "Fix commit 8d8ddd2 in team-alembic/ash_authentication",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/8d8ddd25c69b669a92a701af74bff42e1aada998"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-81632",
    "datePublished": "2026-09-17T13:09:31.601Z",
    "dateReserved": "2026-09-11T18:45:01.476Z",
    "dateUpdated": "2026-09-17T18:29:20.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-4754 (GCVE-0-2025-4754)

Vulnerability from cvelistv5 – Published: 2025-06-17 14:31 – Updated: 2026-09-22 09:23

Title

Missing Session Revocation on Logout in ash_authentication_phoenix

Summary

Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it. This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-17 14:40 UTC

CWE

CWE-613 - Insufficient Session Expiration

Assigner

EEF mitre root

References

6 references

URL	Tags
https://github.com/team-alembic/ash_authenticatio…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2025-4754.html	related
https://osv.dev/vulnerability/EEF-CVE-2025-4754	related
https://github.com/team-alembic/ash_authenticatio…	patch
https://github.com/team-alembic/ash_authenticatio…	related
https://github.com/team-alembic/ash_authenticatio…	patch

Impacted products

2 products

Vendor	Product	Version
team-alembic	ash_authentication_phoenix	Affected: 0.1.0 , < 2.10.0 (semver) cpe:2.3:a:team-alembic:ash_authentication_phoenix::::::::
team-alembic	ash_authentication_phoenix	Affected: 05ab4f438bf0cd0fdfb279d912bbe0d2c3620e02 , < a3253fb4fc7145aeb403537af1c24d3a8d51ffb1 (git) cpe:2.3:a:team-alembic:ash_authentication_phoenix::::::::

Credits

James Harton Zach Daniel Mike Buhot Jonatan Männchen / EEF Josh Price / Alembic

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-4754",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-17T14:40:37.216297Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T14:41:09.297Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Phoenix.Controller\u0027"
          ],
          "packageName": "ash_authentication_phoenix",
          "packageURL": "pkg:hex/ash_authentication_phoenix",
          "product": "ash_authentication_phoenix",
          "programFiles": [
            "lib/ash_authentication_phoenix/controller.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Controller\u0027:\u0027__using__\u0027/1"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication_phoenix",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "2.10.0",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Phoenix.Controller\u0027"
          ],
          "packageName": "team-alembic/ash_authentication_phoenix",
          "packageURL": "pkg:github/team-alembic/ash_authentication_phoenix",
          "product": "ash_authentication_phoenix",
          "programFiles": [
            "lib/ash_authentication_phoenix/controller.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Phoenix.Controller\u0027:\u0027__using__\u0027/1"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication_phoenix",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "a3253fb4fc7145aeb403537af1c24d3a8d51ffb1",
              "status": "affected",
              "version": "05ab4f438bf0cd0fdfb279d912bbe0d2c3620e02",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.10.0",
                  "versionStartIncluding": "0.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "James Harton"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Mike Buhot"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Josh Price / Alembic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards.\u003c/p\u003e\n\u003cp\u003eThe default \u003ccode\u003esign_out/2\u003c/code\u003e that \u003ccode\u003eAshAuthentication.Phoenix.Controller\u003c/code\u003e injects into an application\u0027s auth controller only calls \u003ccode\u003ePlug.Conn.clear_session/1\u003c/code\u003e. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards.\n\nThe default `sign_out/2` that `AshAuthentication.Phoenix.Controller` injects into an application\u0027s auth controller only calls `Plug.Conn.clear_session/1`. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it.\n\nThis issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0."
            }
          ],
          "value": "Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards.\n\nThe default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application\u0027s auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it.\n\nThis issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-593",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-593 Session Hijacking"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T09:23:20.437Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-f7gq-h8jv-h3cq"
        },
        {
          "name": "EEF CNA record for CVE-2025-4754",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2025-4754.html"
        },
        {
          "name": "OSV record EEF-CVE-2025-4754",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2025-4754"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/pull/634"
        },
        {
          "name": "Introducing commit 05ab4f4 in team-alembic/ash_authentication_phoenix",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/05ab4f438bf0cd0fdfb279d912bbe0d2c3620e02"
        },
        {
          "name": "Fix commit a3253fb in team-alembic/ash_authentication_phoenix",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication_phoenix/commit/a3253fb4fc7145aeb403537af1c24d3a8d51ffb1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing Session Revocation on Logout in ash_authentication_phoenix"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2025-4754",
    "datePublished": "2025-06-17T14:31:37.006Z",
    "dateReserved": "2025-05-15T09:03:11.355Z",
    "dateUpdated": "2026-09-22T09:23:20.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities found for ash_authentication_phoenix by team-alembic

CVE-2026-86533 (GCVE-0-2026-86533)

CVE-2026-81632 (GCVE-0-2026-81632)

CVE-2025-4754 (GCVE-0-2025-4754)

CVE-2026-86533 (GCVE-0-2026-86533)

CVE-2026-81632 (GCVE-0-2026-81632)

CVE-2025-4754 (GCVE-0-2025-4754)