AshAuthentication CVE-2026-110826

Exploitation requires all of the following: the log_out_everywhere add-on must be enabled with apply_on_password_change? true (which mix ash_authentication.install writes by default), together with tokens enabled, store_all_tokens? true, and require_token_presence_for_authentication? true; the password must be changed via a non-atomic update action - specifically the generated password reset action or the installer's change_password action - because the where: changing(hashed_password) guard is evaluated before the HashPasswordChange before_action hook sets the new hash, so the guard is always false and tokens are never revoked; and the attacker must already hold one of the victim's valid session tokens. Limiting factors: the attack presupposes a prior session-token compromise (the flaw only prevents the expected revocation, it grants no new access), the vulnerable add-on/configuration must be active, and only versions 4.5.0 before 4.15.1 and 5.0.0-rc.0 before 5.0.0-rc.16 are affected. The only complete fix stated by the vendor is upgrading to 4.15.1 or 5.0.0-rc.16.

This is a medium-severity, precondition-gated session-management flaw rather than a top-priority emergency. The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N, score 6.3) shows a network vector with low complexity but AT:P - an attack requirement - which encodes the key limiter stated in the advisory: the attacker must already hold one of the victim's valid session tokens, and the add-on must be configured with apply_on_password_change? true while the password is changed through a non-atomic action. PR:N reflects that no additional application privileges are needed once a token is held, and the impact is capped at VC:L/VI:L/VA:N (continued read/write access within the compromised session, no availability impact). No EPSS score was provided, so exploitation probability cannot be quantified from this data. The CVE is not listed in CISA KEV and there is no public exploit identified - only the GHSA advisory, the EEF/OSV records, and introducing/fix commits are referenced. The vuln.today decision label is 'this_month', consistent with a real-but-not-urgent issue: meaningful because it defeats a security control users explicitly opted into (log_out_everywhere / password-reset session revocation), but bounded because it presupposes an already-compromised session and a specific configuration. Net: a genuine but conditional priority to patch this month, not a widespread drive-by threat.

An attacker who has already captured a victim's session token (e.g., via an earlier XSS, device theft, or token leak) continues to use that session. The victim, suspecting compromise, resets or changes their password expecting all sessions to be revoked; because the generated password-reset action and the installer's change_password action are non-atomic, the hashed_password change guard never fires and the stored tokens are not revoked, so the attacker's session remains valid. No public exploit code is identified; exploitation requires prior possession of a session token and the vulnerable configuration.