Read the docs
TI-2025-04250 Aliases CVE-2025-4754GHSA-f7gq-h8jv-h3cq

Missing Session Revocation on Logout in ash_authentication_phoenix

Priority LOW 13CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it. This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.005 43rd percentileScored 2026-11-07
Fix Fixed ash_authentication_phoenix (team-alembic): 2.10.0ash_authentication_phoenix (Hex): 2.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
team-alembicash_authentication_phoenix0.1.0 to before 2.10.02.10.0Patch availableCNA
—ash_authentication_phoenix (Hex)before 2.10.02.10.0Patch availableGHSA-f7gq-h8jv-h3cq
  • ash_authentication_phoenix Vendorteam-alembic Affected 0.1.0 to before 2.10.0 Fixed in 2.10.0 Patch available CNA
  • ash_authentication_phoenix (Hex) Vendor— Affected before 2.10.0 Fixed in 2.10.0 Patch available GHSA-f7gq-h8jv-h3cq

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA ash_authentication_phoenix (team-alembic) Fixed in 2.10.0
  • Fix · GHSA-f7gq-h8jv-h3cq ash_authentication_phoenix (Hex) Fixed in 2.10.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-4754
  2. 2026-10-03 Alias added: GHSA-f7gq-h8jv-h3cq

References

Patch 2

Advisory 2

Other 4

  • TI-2026-36668 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching CVSS 4.0CRITICAL 9.2
  • TI-2026-46782 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication CVSS 4.0HIGH 7.6
  • TI-2026-59214 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix CVSS 4.0CRITICAL 9.1
  • TI-2026-58664 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication CVSS 4.0CRITICAL 9.1
  • TI-2026-53751 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement CVSS 4.0CRITICAL 9.1
  • TI-2026-57079 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication CVSS 4.0CRITICAL 9.1
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences