EUVD-2026-82579Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because the attacker must first plant an identifier and the target must use a server-side session store; UI:R since the victim must sign in; PR:N and C:H/I:H for full account takeover, A:N.
Primary rating from Vendor (6b3ad84c-e1a6-4bf7-a703-f496b71e49db).
CVSS VectorVendor: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Lifecycle Timeline
7DescriptionCVE.org
Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in.
AshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session with Plug.Conn.put_session/3 and never calls Plug.Conn.configure_session(renew: true), so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default success/4 injected by AshAuthentication.Phoenix.Controller.__using__/1, the AuthController emitted by mix ash_authentication_phoenix.install, and remember-me auto-login. AshAuthentication.Phoenix.Plug.store_in_session/2 is a defdelegate to it. Logout does not close the window either, because clear_session/2 ends with Plug.Conn.clear_session/1, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle.
This issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
AnalysisAI
Session fixation in the Elixir/Phoenix authentication library ash_authentication (0.2.0 before 4.15.0, and 5.0.0-rc.0 before 5.0.0-rc.14) allows an attacker who has pre-planted a session identifier in a victim's browser to ride that identifier into the victim's authenticated session. AshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session with Plug.Conn.put_session/3 and never calls Plug.Conn.configure_session(renew: true), so the identifier the visitor arrived with survives into their logged-in session through every authentication path, including the default success/4, the mix ash_authentication_phoenix.install AuthController, and remember-me auto-login; logout does not close the window because clear_session/2 ends with Plug.Conn.clear_session/1, which wipes contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a server-side session store (e.g., ETS or database) where a rotatable session identifier exists - deployments using Phoenix's default signed cookie session store are largely unaffected because there is no identifier to fixate. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional session-fixation flaw (CWE-384) in ash_authentication, an Elixir/Phoenix authentication library. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade ash_authentication to 4.15.0 or, on the 5.0 release-candidate line, to 5.0.0-rc.14 or later; the fix adds Plug.Conn.configure_session(conn, renew: true) immediately before the subject is written in AshAuthentication.Plug.Helpers.store_in_session/2, issuing a new identifier while carrying session contents such as return_to and flash across. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Phoenix service that depends on ash_authentication and flag those running any version from 0.2.0 up to but not including 4.15.0, or 5.0.0-rc.0 up to but not including 5.0.0-rc.14, prioritizing internet-facing authentication and remember-me endpoints, and confirm whether sessions are bound to any client attributes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Session Fixation
View allSession hijacking in self-hosted Zammad 6.3.0 through 6.5.4 allows remote, unauthenticated attackers to take over a legi
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID pa
Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session
Tiny File Manager v2.4.7 and below is vulnerable to session fixation. Rated critical severity (CVSS 9.8), this vulnerabi
A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /login
Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. Rated criti
An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to exe
A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to ex
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7. Rated critical severity (CVSS 9.8), this vulnerab
Certain NetModule devices allow Limited Session Fixation via PHPSESSID. Rated critical severity (CVSS 9.8), this vulnera
An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Rated critical severity (CVSS 9.8), this v
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests be
Same weakness CWE-384 – Session Fixation
View allShare
External POC / Exploit Code
Leaving vuln.today