EUVD-2026-81480Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable with no auth (PR:N) and no victim interaction, but AC:H because success requires holding a leaked token and winning a non-deterministic revocation race; account takeover yields C:H/I:H, no availability impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with single_use_token?, which is the default, is meant to be redeemable exactly once, but nothing serialises the token's validity check against its consumption, so concurrent redemptions of one token all succeed and each yields a full user token.
Sign-in verifies the JWT with Jwt.verify/4 and revokes it only afterwards: AshAuthentication.Strategy.MagicLink.SignInPreparation revokes in a Query.after_action callback, and AshAuthentication.Strategy.MagicLink.SignInChange in an after_transaction hook that runs once the sign-in has already committed. AshAuthentication.TokenResource.Actions.revoke/3 writes the revocation as an upsert, so a concurrent duplicate revocation silently succeeds instead of conflicting and no request ever loses the race.
This issue affects ash_authentication: from 3.9.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
AnalysisAI
Reusing a leaked single-use magic-link token is possible in the Elixir library ash_authentication because its validity check and its revocation are not serialised: concurrent sign-in redemptions of the same token can all succeed, each returning a full user JWT and authenticating the attacker as the target subject. Affected are ash_authentication versions from 3.9.0 before 4.15.0 and 5.0.0-rc.0 before 5.0.0-rc.14, with single_use_token? …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the magic-link strategy is in use with single_use_token? … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional vulnerability whose real-world risk is materially lower than its headline 9.1 (CVSS 4.0) suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade ash_authentication to 4.15.0 on the 4.x line, or to 5.0.0-rc.14 on the 5.0 release-candidate line; the associated upstream changes are the commits cf3d227ef25912cf1b0c5fa80f20001f5c46a102, 18dfdb36c14aa6a61df8572bce2d5ec36b1d9840 and 9ef6864b8833d3b795427a7b8dc518a4997d41ab, with details in advisory GHSA-23gr-vcp4-r27q. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Elixir applications and services using ash_authentication versions 3.9.0 up to but not including 4.15.0, and 5.0.0-rc.0 up to but not including 5.0.0-rc.14, confirm whether single_use_token? …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Authentication
View allAsh Authentication is an authentication framework for Elixir applications. Rated medium severity (CVSS 6.3), this vulner
Account takeover in team-alembic AshAuthentication (0.1.0 to <4.14.0 and 5.0.0-rc.0 to <5.0.0-rc.10) lets an unauthentic
Authentication bypass in the Elixir library ash_authentication lets an attacker who operates one federated identity-prov
Account takeover in AshAuthentication (Elixir/Ash) 4.14.0 through 4.14.x and 5.0.0-rc.10 through 5.0.0-rc.13 lets unauth
Unconfirmed accounts can obtain an authenticated session in the AshAuthentication Elixir library, defeating the mandator
Revoked sessions continue to be treated as fully authenticated on affected AshAuthentication and AshAuthentication Phoen
Denial of service in the AshAuthentication API-key sign-in strategy lets an unauthenticated, remote attacker exhaust ser
JWT token replay in AshAuthentication exposes any application using the stateless bearer-token path to full account take
Authentication bypass in the AshAuthentication library for Elixir/Ash lets an authenticated attacker who holds a valid s
An authenticated account-takeover primitive exists in the Elixir library AshAuthentication (ash_authentication) versions
Password sign-in in AshAuthentication Phoenix (ash_authentication_phoenix 1.7.0 to <2.17.4 and 3.0.0-rc.0 to <3.0.0-rc.1
AshAuthentication's token-revocation action accepts forged JWTs without verifying their signature, letting an unauthenti
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today