CWE-1466
Monthly
Sessions remain valid in AshAuthentication after a victim resets or changes their password, so an attacker who already holds one of the victim's session tokens stays signed in despite the credential change. Only deployments using the log_out_everywhere add-on with apply_on_password_change? true (which mix ash_authentication.install writes by default) - combined with tokens enabled, store_all_tokens? true and require_token_presence_for_authentication? true - are affected, and only when the password is changed through a non-atomic action such as the generated password reset action or the installer's change_password action; versions 4.5.0 before 4.15.1 and 5.0.0-rc.0 before 5.0.0-rc.16 are impacted. Severity is medium (CNA score 6.3 under CVSS 4.0; assessor vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), no public exploit has been identified at time of analysis, and vendor-released patches are available in 4.15.1 and 5.0.0-rc.16.
Sessions remain valid in AshAuthentication after a victim resets or changes their password, so an attacker who already holds one of the victim's session tokens stays signed in despite the credential change. Only deployments using the log_out_everywhere add-on with apply_on_password_change? true (which mix ash_authentication.install writes by default) - combined with tokens enabled, store_all_tokens? true and require_token_presence_for_authentication? true - are affected, and only when the password is changed through a non-atomic action such as the generated password reset action or the installer's change_password action; versions 4.5.0 before 4.15.1 and 5.0.0-rc.0 before 5.0.0-rc.16 are impacted. Severity is medium (CNA score 6.3 under CVSS 4.0; assessor vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), no public exploit has been identified at time of analysis, and vendor-released patches are available in 4.15.1 and 5.0.0-rc.16.