CVE-2026-81637

Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

CVSS 4.0 2.3 LOWCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-81637

Published

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored session_params through a rebinding step inside its with chain, conn <- delete_session(conn, session_key). Elixir evaluates the else block in the scope enclosing the with, so every failure path (the provider returning ?error=access_denied, an invalid code, a token-exchange error, or a registration or sign-in failure) reaches store_authentication_result/2 holding the original connection and the session entry is never removed. The value the module's own comment describes as protection against a CSRF-related attack is therefore consumed only when authentication succeeds, and survives a cancelled or failed attempt until the next request phase or session expiry. This issue affects ash_authentication: from 0.6.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-81637

Published

ash_authentication

https://repo.hex.pm

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://repo.hex.pm",
                    "cpes": [
                        "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.AshAuthentication.Strategy.OAuth2.Plug'"
                    ],
                    "packageName": "ash_authentication",
                    "packageURL": "pkg:hex/ash_authentication",
                    "product": "ash_authentication",
                    "programFiles": [
                        "lib/ash_authentication/strategies/oauth2/plug.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.AshAuthentication.Strategy.OAuth2.Plug':callback/2"
                        },
                        {
                            "name": "'Elixir.AshAuthentication.Strategy.OAuth2.Plug':request/2"
                        }
                    ],
                    "repo": "https://github.com/team-alembic/ash_authentication",
                    "vendor": "team-alembic",
                    "versions": [
                        {
                            "lessThan": "4.15.0",
                            "status": "affected",
                            "version": "0.6.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "5.0.0-rc.14",
                            "status": "affected",
                            "version": "5.0.0-rc.0",
                            "versionType": "semver"
                        }
                    ]
                }

team-alembic/ash_authentication

https://github.com

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://github.com",
                    "cpes": [
                        "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.AshAuthentication.Strategy.OAuth2.Plug'"
                    ],
                    "packageName": "team-alembic/ash_authentication",
                    "packageURL": "pkg:github/team-alembic/ash_authentication",
                    "product": "ash_authentication",
                    "programFiles": [
                        "lib/ash_authentication/strategies/oauth2/plug.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.AshAuthentication.Strategy.OAuth2.Plug':callback/2"
                        },
                        {
                            "name": "'Elixir.AshAuthentication.Strategy.OAuth2.Plug':request/2"
                        }
                    ],
                    "repo": "https://github.com/team-alembic/ash_authentication",
                    "vendor": "team-alembic",
                    "versions": [
                        {
                            "changes": [
                                {
                                    "at": "bd4352303bc9d72d007f6818775267585a4bcc2f",
                                    "status": "unaffected"
                                },
                                {
                                    "at": "d7f939cd02bd618bcaa304631846fa75ffc419d7",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThan": "*",
                            "status": "affected",
                            "version": "c5f589058e04239263f50a1430eb17ea6d5dd1a2",
                            "versionType": "git"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON