Read the docs
TI-2026-53751 Aliases CVE-2026-76949

Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

Priority MEDIUM 49CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account. AshAuthentication.Plug.Helpers.sign_in_using_remember_me/3 skips re-authenticating an already-signed-in visitor by checking the session for "<subject_name>_token", but store_in_session/2 writes that key only when require_token_presence_for_authentication? is enabled and otherwise writes the bare subject name. At the default setting the guard therefore reads a key that is never written, its already-signed-in branch is unreachable, and the remember-me sign-in runs on every request through the per-request browser pipeline plug. A planted remember-me cookie is consequently honoured even for a visitor holding a live authenticated session, so whatever the victim enters afterwards lands in data the attacker controls. The read path in authenticate_resource_from_session/4 selects the key correctly, so the guard and the reader disagree about which key holds the session. This issue affects ash_authentication: from 4.10.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00772 55th percentileScored 2026-11-07
Fix Fixed ash_authentication (team-alembic): 4.15.0, 5.0.0-rc.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
team-alembicash_authentication4.10.0 to before 4.15.0; 5.0.0-rc.0 to before 5.0.0-rc.144.15.0, 5.0.0-rc.14Patch availableCNA
  • ash_authentication Vendorteam-alembic Affected 4.10.0 to before 4.15.0; 5.0.0-rc.0 to before 5.0.0-rc.14 Fixed in 4.15.0, 5.0.0-rc.14 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA ash_authentication (team-alembic) Fixed in 4.15.0, 5.0.0-rc.14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    team-alembic ash_authentication 4.15.0, 5.0.0-rc.14

    14 records Highest priority Priority MEDIUM 5 MEDIUM, 9 LOW

    Other records, highest priority first

    • TI-2026-59214 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication PhoenixPriority MEDIUM 49
    • TI-2026-58664 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthenticationPriority MEDIUM 49
    • TI-2026-57079 Magic link single-use tokens replayable via TOCTOU race in AshAuthenticationPriority MEDIUM 48
    Show all 14 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76949

References

Patch 2

Advisory 1

Other 3

  • TI-2026-36668 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching CVSS 4.0CRITICAL 9.2
  • TI-2026-46782 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication CVSS 4.0HIGH 7.6
  • TI-2026-59214 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix CVSS 4.0CRITICAL 9.1
  • TI-2026-58664 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication CVSS 4.0CRITICAL 9.1
  • TI-2026-57079 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication CVSS 4.0CRITICAL 9.1
  • TI-2026-47468 Reflected XSS in AshAuthentication confirmation and magic link interaction forms CVSS 4.0LOW 2.1
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences