Read the docs
TI-2026-59214 Aliases CVE-2026-86533

Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

Priority MEDIUM 49CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working. This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00908 60th percentileScored 2026-11-07
Fix Fixed ash_authentication (team-alembic): 4.15.0, 5.0.0-rc.14ash_authentication_phoenix (team-alembic): 2.17.4, 3.0.0-rc.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
team-alembicash_authentication4.9.1 to before 4.15.0; 5.0.0-rc.0 to before 5.0.0-rc.144.15.0, 5.0.0-rc.14Patch availableCNA
team-alembicash_authentication_phoenix2.10.0 to before 2.17.4; 3.0.0-rc.0 to before 3.0.0-rc.112.17.4, 3.0.0-rc.11Patch availableCNA
  • ash_authentication Vendorteam-alembic Affected 4.9.1 to before 4.15.0; 5.0.0-rc.0 to before 5.0.0-rc.14 Fixed in 4.15.0, 5.0.0-rc.14 Patch available CNA
  • ash_authentication_phoenix Vendorteam-alembic Affected 2.10.0 to before 2.17.4; 3.0.0-rc.0 to before 3.0.0-rc.11 Fixed in 2.17.4, 3.0.0-rc.11 Patch available CNA

CPE names CNA · 2

CPEVersionsRoleVendor
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*———
cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:* Versions — — ·—
  • cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA ash_authentication (team-alembic) Fixed in 4.15.0, 5.0.0-rc.14
  • Fix · CNA ash_authentication_phoenix (team-alembic) Fixed in 2.17.4, 3.0.0-rc.11

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    team-alembic ash_authentication 4.15.0, 5.0.0-rc.14

    14 records Highest priority Priority MEDIUM 5 MEDIUM, 9 LOW

    Other records, highest priority first

    • TI-2026-58664 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthenticationPriority MEDIUM 49
    • TI-2026-53751 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacementPriority MEDIUM 49
    • TI-2026-57079 Magic link single-use tokens replayable via TOCTOU race in AshAuthenticationPriority MEDIUM 48
    Show all 14 records →
  • Release ·

    team-alembic ash_authentication_phoenix 2.17.4, 3.0.0-rc.11

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-56294 Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenixPriority LOW 33
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-86533

References

Patch 3

Advisory 2

Other 5

  • TI-2026-36668 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching CVSS 4.0CRITICAL 9.2
  • TI-2026-46782 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication CVSS 4.0HIGH 7.6
  • TI-2026-58664 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication CVSS 4.0CRITICAL 9.1
  • TI-2026-53751 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement CVSS 4.0CRITICAL 9.1
  • TI-2026-57079 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication CVSS 4.0CRITICAL 9.1
  • TI-2026-47468 Reflected XSS in AshAuthentication confirmation and magic link interaction forms CVSS 4.0LOW 2.1
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences