Read the docs
TI-2026-54404 Aliases CVE-2026-78223

Token revocation record built from unverified JWT claims in AshAuthentication

Priority LOW 37CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the :token argument and decodes it with AshAuthentication.Jwt.peek/1, which delegates to Joken.peek_claims/1 and performs no signature check, unlike Jwt.verify/4. The jti, exp and sub claims it returns are written straight onto the revocation record, guarded only by byte_size(token) > 0. Because expires_at derives from the attacker-chosen exp, a forged copy of a genuine token that keeps the real jti but backdates exp yields a revocation row that is already expired: expunge_expired removes it and the genuine token passes revoked? again. Arbitrary jti and sub values can be inserted the same way. This issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00441 38th percentileScored 2026-11-07
Fix Fixed ash_authentication (team-alembic): 4.15.0, 5.0.0-rc.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
team-alembicash_authentication0.2.0 to before 4.15.0; 5.0.0-rc.0 to before 5.0.0-rc.144.15.0, 5.0.0-rc.14Patch availableCNA
  • ash_authentication Vendorteam-alembic Affected 0.2.0 to before 4.15.0; 5.0.0-rc.0 to before 5.0.0-rc.14 Fixed in 4.15.0, 5.0.0-rc.14 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA ash_authentication (team-alembic) Fixed in 4.15.0, 5.0.0-rc.14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    team-alembic ash_authentication 4.15.0, 5.0.0-rc.14

    14 records Highest priority Priority MEDIUM 5 MEDIUM, 9 LOW

    Other records, highest priority first

    • TI-2026-59214 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication PhoenixPriority MEDIUM 49
    • TI-2026-58664 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthenticationPriority MEDIUM 49
    • TI-2026-53751 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacementPriority MEDIUM 49
    Show all 14 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-78223

References

Patch 2

Advisory 1

Other 3

  • TI-2026-36668 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching CVSS 4.0CRITICAL 9.2
  • TI-2026-46782 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication CVSS 4.0HIGH 7.6
  • TI-2026-59214 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix CVSS 4.0CRITICAL 9.1
  • TI-2026-58664 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication CVSS 4.0CRITICAL 9.1
  • TI-2026-53751 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement CVSS 4.0CRITICAL 9.1
  • TI-2026-57079 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication CVSS 4.0CRITICAL 9.1
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences