Read the docs
TI-2026-84482 Aliases CVE-2026-110826

AshAuthentication sessions stay valid after password reset or change

Priority LOW 29CWE-1466Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

team-alembic ash_authentication from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16 does not revoke stored session tokens when a password changes through a non-atomic action, such as the generated password reset action. An unauthenticated remote attacker who holds a victim's session token stays signed in after the victim resets or changes their password, because the log out everywhere add-on skips revocation (CWE-1466). No user interaction is needed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With apply_on_password_change? true, AshAuthentication.AddOn.LogOutEverywhere.Transformer adds OnPasswordChange to update actions as a global change guarded by where: changing(hashed_password). That condition is evaluated before the action's before_action hooks run, but AshAuthentication.Strategy.Password.HashPasswordChange sets the new hash in a before_action hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's change_password action are both non-atomic. This issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00482 41st percentileScored 2026-11-07
Fix Fixed ash_authentication (team-alembic): 4.15.1, 5.0.0-rc.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
team-alembicash_authentication4.5.0 to before 4.15.1; 5.0.0-rc.0 to before 5.0.0-rc.164.15.1, 5.0.0-rc.16Patch availableCNA
  • ash_authentication Vendorteam-alembic Affected 4.5.0 to before 4.15.1; 5.0.0-rc.0 to before 5.0.0-rc.16 Fixed in 4.15.1, 5.0.0-rc.16 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Upgrade ash_authentication to 4.15.1 or to 5.0.0-rc.16, whichever matches the installed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA ash_authentication (team-alembic) Fixed in 4.15.1, 5.0.0-rc.16

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-110826
  2. 2026-11-03 CISA SSVC decision points changed
  3. 2026-11-03 Priority changed: MEDIUM → LOW

References

Patch 2

Advisory 1

Other 3

  • TI-2026-36668 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching CVSS 4.0CRITICAL 9.2
  • TI-2026-46782 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication CVSS 4.0HIGH 7.6
  • TI-2026-59214 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix CVSS 4.0CRITICAL 9.1
  • TI-2026-58664 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication CVSS 4.0CRITICAL 9.1
  • TI-2026-53751 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement CVSS 4.0CRITICAL 9.1
  • TI-2026-57079 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication CVSS 4.0CRITICAL 9.1
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences