Security Advisory catalog CVE-2026-86533
cve-program · CVE-2026-86533 Published
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.
A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.
This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-86533 Published ash_authentication https://repo.hex.pm
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.AshAuthentication.Plug.Helpers'"
],
"packageName": "ash_authentication",
"packageURL": "pkg:hex/ash_authentication",
"product": "ash_authentication",
"programFiles": [
"lib/ash_authentication/plug/helpers.ex"
],
"programRoutines": [
{
"name": "'Elixir.AshAuthentication.Plug.Helpers':retrieve_from_session/3"
},
{
"name": "'Elixir.AshAuthentication.Plug.Helpers':authenticate_resource_from_session/4"
}
],
"repo": "https://github.com/team-alembic/ash_authentication",
"vendor": "team-alembic",
"versions": [
{
"lessThan": "4.15.0",
"status": "affected",
"version": "4.9.1",
"versionType": "semver"
},
{
"lessThan": "5.0.0-rc.14",
"status": "affected",
"version": "5.0.0-rc.0",
"versionType": "semver"
}
]
} team-alembic/ash_authentication https://github.com
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.AshAuthentication.Plug.Helpers'"
],
"packageName": "team-alembic/ash_authentication",
"packageURL": "pkg:github/team-alembic/ash_authentication",
"product": "ash_authentication",
"programFiles": [
"lib/ash_authentication/plug/helpers.ex"
],
"programRoutines": [
{
"name": "'Elixir.AshAuthentication.Plug.Helpers':retrieve_from_session/3"
},
{
"name": "'Elixir.AshAuthentication.Plug.Helpers':authenticate_resource_from_session/4"
}
],
"repo": "https://github.com/team-alembic/ash_authentication",
"vendor": "team-alembic",
"versions": [
{
"changes": [
{
"at": "a3f49f758f013d2ff086dd9c5ef2d94e921711b4",
"status": "unaffected"
},
{
"at": "e28e911caa9728d76329afdb0fb26742ffe4eeef",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "fcaeb73f76f8f2e9aef8bf637690d2a20dd97596",
"versionType": "git"
}
]
} ash_authentication_phoenix https://repo.hex.pm
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.AshAuthentication.Phoenix.LiveSession'"
],
"packageName": "ash_authentication_phoenix",
"packageURL": "pkg:hex/ash_authentication_phoenix",
"product": "ash_authentication_phoenix",
"programFiles": [
"lib/ash_authentication_phoenix/live_session.ex"
],
"programRoutines": [
{
"name": "'Elixir.AshAuthentication.Phoenix.LiveSession':on_mount/4"
}
],
"repo": "https://github.com/team-alembic/ash_authentication_phoenix",
"vendor": "team-alembic",
"versions": [
{
"lessThan": "2.17.4",
"status": "affected",
"version": "2.10.0",
"versionType": "semver"
},
{
"lessThan": "3.0.0-rc.11",
"status": "affected",
"version": "3.0.0-rc.0",
"versionType": "semver"
}
]
} team-alembic/ash_authentication_phoenix https://github.com
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.AshAuthentication.Phoenix.LiveSession'"
],
"packageName": "team-alembic/ash_authentication_phoenix",
"packageURL": "pkg:github/team-alembic/ash_authentication_phoenix",
"product": "ash_authentication_phoenix",
"programFiles": [
"lib/ash_authentication_phoenix/live_session.ex"
],
"programRoutines": [
{
"name": "'Elixir.AshAuthentication.Phoenix.LiveSession':on_mount/4"
}
],
"repo": "https://github.com/team-alembic/ash_authentication_phoenix",
"vendor": "team-alembic",
"versions": [
{
"changes": [
{
"at": "f7ab005a2aac09707a25521653c94893d328cc52",
"status": "unaffected"
},
{
"at": "0135217e34e621dac79ae3d9559aeee49304b0aa",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "a3253fb4fc7145aeb403537af1c24d3a8d51ffb1",
"versionType": "git"
},
{
"changes": [
{
"at": "f7ab005a2aac09707a25521653c94893d328cc52",
"status": "unaffected"
},
{
"at": "0135217e34e621dac79ae3d9559aeee49304b0aa",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "0135217e34e621dac79ae3d9559aeee49304b0aa",
"versionType": "git"
}
]
} Original source record · Cite this exact observation · Complete original publisher JSON