EEF-CVE-2026-82761
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-82761.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-82761.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-82761
- Aliases
-
- CVE-2026-82761
- GHSA-23gr-vcp4-r27q
- Published
- 2026-09-17T13:09:01Z
- Modified
- 2026-09-17T13:26:03Z
- Severity
-
- 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
- Details
-
Summary
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with
single_use_token?, which is the default, is meant to be redeemable exactly once, but nothing serialises the token's validity check against its consumption, so concurrent redemptions of one token all succeed and each yields a full user token.Sign-in verifies the JWT with
Jwt.verify/4and revokes it only afterwards:AshAuthentication.Strategy.MagicLink.SignInPreparationrevokes in aQuery.after_actioncallback, andAshAuthentication.Strategy.MagicLink.SignInChangein anafter_transactionhook that runs once the sign-in has already committed.AshAuthentication.TokenResource.Actions.revoke/3writes the revocation as an upsert, so a concurrent duplicate revocation silently succeeds instead of conflicting and no request ever loses the race.This issue affects ash_authentication: from 3.9.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
- Database specific
{ "capec_ids": [ "CAPEC-29" ], "cpe_ids": [ "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*" ], "cwe_ids": [ "CWE-367" ] }- References
-
- https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-23gr-vcp4-r27q
- https://cna.erlef.org/cves/CVE-2026-82761.html
- https://github.com/team-alembic/ash_authentication/commit/cf3d227ef25912cf1b0c5fa80f20001f5c46a102
- https://github.com/team-alembic/ash_authentication/commit/18dfdb36c14aa6a61df8572bce2d5ec36b1d9840
- https://github.com/team-alembic/ash_authentication/commit/9ef6864b8833d3b795427a7b8dc518a4997d41ab
- https://hex.pm/packages/ash_authentication
- Credits
-
-
- James Harton - REMEDIATION_DEVELOPER
-
- Peter Ullrich - REPORTER
-
- Jonatan Männchen / EEF - ANALYST
-
Affected packages
Hex / ash_authentication
Package
- Name
- ash_authentication
- Purl
- pkg:hex/ash_authentication
Affected ranges
- Type
- SEMVER
- Events
-
Introduced3.9.0Fixed4.15.0
- Type
- SEMVER
- Events
-
Introduced5.0.0-rc.0Fixed5.0.0-rc.14