Ash Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install`
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.
Summary
Ash Authentication is an authentication framework for Elixir applications. Applications which have been bootstrapped by the igniter installer present since AshAuthentication v4.1.0 and who have used the magic link strategy _or_ are manually revoking tokens are affected by revoked tokens being allowed to verify as valid. Unless one hase implemented any kind of custom token revocation feature in your application, then one will not be affected. The impact here for users using builtin functionality is that magic link tokens are reusable until they expire. With that said, magic link tokens are only valid for 10 minutes, so the surface area for abuse is extremely low here. The flaw is patched in version 4.4.9. Additionally a compile time warning is shown to users with remediation instructions if they upgrade. 4.4.9 ships with an upgrader, so those who use `mix igniter.upgrade ash_authentication` will have the necessary patch applied. Otherwise, one may run the upgrader manually as described in the error message. As a workaround, delete the generated `:revoked?` generic action in the token resource. This will cause it to use the one internal to Ash Authentication which has always been correct. Alternatively, manually make the changes that are included in the patch.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| team-alembic | ash_authentication | 4.1.0 to before 4.4.9 | 4.4.9 | Patch available | CNA |
| — | ash_authentication (Hex) | 4.1.0 to before 4.4.9 | 4.4.9 | Patch available | GHSA-qrm9-f75w-hg4c |
- ash_authentication Vendorteam-alembic Affected 4.1.0 to before 4.4.9 Fixed in 4.4.9 Patch available CNA
- ash_authentication (Hex) Vendor— Affected 4.1.0 to before 4.4.9 Fixed in 4.4.9 Patch available GHSA-qrm9-f75w-hg4c
Remediation
- Fix · CNA ash_authentication (team-alembic) Fixed in 4.4.9
- Fix · GHSA-qrm9-f75w-hg4c ash_authentication (Hex) Fixed in 4.4.9 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-25202
- 2026-10-03 Alias added: GHSA-qrm9-f75w-hg4c
References
Patch 1
More team-alembic vulnerabilities
- TI-2026-36668 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching CVSS 4.0CRITICAL 9.2
- TI-2026-46782 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication CVSS 4.0HIGH 7.6
- TI-2026-59214 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix CVSS 4.0CRITICAL 9.1
- TI-2026-58664 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication CVSS 4.0CRITICAL 9.1
- TI-2026-53751 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement CVSS 4.0CRITICAL 9.1
- TI-2026-57079 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication CVSS 4.0CRITICAL 9.1
Sources
- CVE-2025-25202 · CVE Program
- CVE-2025-25202 · NVD
- FIRST EPSS
- GHSA-qrm9-f75w-hg4c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences