EUVD-2026-81486Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because it needs a non-default :jti/token-presence-off config plus a session captured before logout; PR:N/UI:N as the attacker acts with a stolen session; full account access gives C:H/I:H, A:N.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.
A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.
This issue affects ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 onward; ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
AnalysisAI
Revoked sessions continue to be treated as fully authenticated on affected AshAuthentication and AshAuthentication Phoenix deployments, so anyone holding a session value captured before the victim signed out can keep acting as that user indefinitely. The flaw affects ash_authentication_phoenix from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 onward, and ash_authentication from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14, but only for resources configured with session_identifier :jti while require_token_presence_for_authentication? …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a resource configured with session_identifier :jti AND require_token_presence_for_authentication? … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine session-management flaw whose real-world risk is moderate-to-high but gated by non-default configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches exist: upgrade ash_authentication_phoenix to 2.17.4 or later (or the corresponding fixed 3.x release) and ash_authentication to 4.15.0 or later (or 5.0.0-rc.14 or later for the 5.0 release-candidate line), per GHSA-m6x4-4gvp-xwjr and GHSA-w374-hvrx-66hg. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Elixir service that depends on ash_authentication or ash_authentication_phoenix and determine which are configured with session_identifier :jti while require_token_presence_for_authentication? …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Authentication
View allAsh Authentication is an authentication framework for Elixir applications. Rated medium severity (CVSS 6.3), this vulner
Account takeover in team-alembic AshAuthentication (0.1.0 to <4.14.0 and 5.0.0-rc.0 to <5.0.0-rc.10) lets an unauthentic
Authentication bypass in the Elixir library ash_authentication lets an attacker who operates one federated identity-prov
Account takeover in AshAuthentication (Elixir/Ash) 4.14.0 through 4.14.x and 5.0.0-rc.10 through 5.0.0-rc.13 lets unauth
Unconfirmed accounts can obtain an authenticated session in the AshAuthentication Elixir library, defeating the mandator
Reusing a leaked single-use magic-link token is possible in the Elixir library ash_authentication because its validity c
Denial of service in the AshAuthentication API-key sign-in strategy lets an unauthenticated, remote attacker exhaust ser
JWT token replay in AshAuthentication exposes any application using the stateless bearer-token path to full account take
Authentication bypass in the AshAuthentication library for Elixir/Ash lets an authenticated attacker who holds a valid s
An authenticated account-takeover primitive exists in the Elixir library AshAuthentication (ash_authentication) versions
Password sign-in in AshAuthentication Phoenix (ash_authentication_phoenix 1.7.0 to <2.17.4 and 3.0.0-rc.0 to <3.0.0-rc.1
AshAuthentication's token-revocation action accepts forged JWTs without verifying their signature, letting an unauthenti
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today