EUVD-2026-82578Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H and UI:R because the attacker must plant a cookie via a separate injection channel and the victim must then interact/enter data; C:H/I:H as victim data flows into the attacker-controlled account, A:N.
Primary rating from Vendor (6b3ad84c-e1a6-4bf7-a703-f496b71e49db).
CVSS VectorVendor: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Lifecycle Timeline
5DescriptionCVE.org
Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account.
AshAuthentication.Plug.Helpers.sign_in_using_remember_me/3 skips re-authenticating an already-signed-in visitor by checking the session for "<subject_name>_token", but store_in_session/2 writes that key only when require_token_presence_for_authentication? is enabled and otherwise writes the bare subject name. At the default setting the guard therefore reads a key that is never written, its already-signed-in branch is unreachable, and the remember-me sign-in runs on every request through the per-request browser pipeline plug. A planted remember-me cookie is consequently honoured even for a visitor holding a live authenticated session, so whatever the victim enters afterwards lands in data the attacker controls. The read path in authenticate_resource_from_session/4 selects the key correctly, so the guard and the reader disagree about which key holds the session.
This issue affects ash_authentication: from 4.10.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
AnalysisAI
Session-swapping authentication bypass in the Elixir library AshAuthentication (versions 4.10.0 before 4.15.0 and 5.0.0-rc.0 before 5.0.0-rc.14) allows an attacker who can plant a remember-me cookie in a victim's browser to displace the victim's live authenticated session with one belonging to the attacker's own account, so anything the victim enters afterwards is captured under attacker-controlled state. The root cause is a guard/reader key mismatch: AshAuthentication.Plug.Helpers.sign_in_using_remember_me/3 checks the session for a '<subject_name>_token' key, but store_in_session/2 only writes that key when require_token_presence_for_authentication? …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires ash_authentication 4.10.0-<4.15.0 or 5.0.0-rc.0-<5.0.0-rc.14 running the per-request browser pipeline plug at the DEFAULT token setting (require_token_presence_for_authentication? … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict on severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade AshAuthentication to the fixed releases: 4.15.0 for the 4.x line, or 5.0.0-rc.14 for the 5.0.0 prerelease line - these correspond to the upstream fix commits referenced in GHSA-hh34-374j-pfr5 (https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-hh34-374j-pfr5), with the advisory index at https://cna.erlef.org/cves/CVE-2026-76949.html and the OSV entry at https://osv.dev/vulnerability/EEF-CVE-2026-76949; vendor-released patch versions are 4.15.0 and 5.0.0-rc.14. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every application that depends on the AshAuthentication Elixir library and confirm the exact version in use, flagging any deployment on 4.10.0 up to but not including 4.15.0, or 5.0.0-rc.0 up to but not including 5.0.0-rc.14, as exposed; where remember-me is not business-required, disable the remember-me feature and its per-request browser pipeline plug entirely, and where it is required, enable require_token_presence_for_authentication? …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unbounded recursion in the Elixir `protobuf` Hex package (versions >= 0.8.0, < 0.16.1) lets unauthenticated remote attac
Improper JWT signature verification in Dashbit's nimble_zta (0.1.2 up to but not including 0.1.3) lets an unauthenticate
Authentication bypass in the Elixir library ash_authentication lets an attacker who operates one federated identity-prov
Account takeover in AshAuthentication (Elixir/Ash) 4.14.0 through 4.14.x and 5.0.0-rc.10 through 5.0.0-rc.13 lets unauth
Server-Side Request Forgery protection bypass in the Elixir safeurl library (versions 0.1.0 and later) allows unauthenti
Memory-exhaustion denial of service in the elixir-protobuf library (protobuf) from 0.8.0 onward allows an unauthenticate
Atom table exhaustion in the Ash framework (Elixir) allows an unauthenticated remote attacker to crash a BEAM node by su
Ciphertext tampering in the Cloak Elixir encryption library (danielberkompas/cloak, all versions from 0.1.0-pre onward)
Memory exhaustion denial-of-service in Elixir Mint affects versions 1.1.0 through 1.10.x and allows a malicious or compr
Authentication bypass in the AshAuthentication library for Elixir/Ash lets an authenticated attacker who holds a valid s
An authenticated account-takeover primitive exists in the Elixir library AshAuthentication (ash_authentication) versions
Session fixation in the Elixir/Phoenix authentication library ash_authentication (0.2.0 before 4.15.0, and 5.0.0-rc.0 be
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today