EEF-CVE-2026-86533

See a problem?
Please try reporting it to the source first.
Source
https://cna.erlef.org/osv/EEF-CVE-2026-86533.html
Import Source
https://cna.erlef.org/osv/EEF-CVE-2026-86533.json
JSON Data
https://api.osv.dev/v1/vulns/EEF-CVE-2026-86533
Aliases
  • CVE-2026-86533
  • GHSA-m6x4-4gvp-xwjr
Published
2026-09-17T13:09:37Z
Modified
2026-09-17T14:15:02Z
Severity
  • 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Details

Summary

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.

A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.

This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.

Database specific 
{
    "capec_ids": [
        "CAPEC-60"
    ],
    "cpe_ids": [
        "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
        "CWE-613"
    ]
}
References
Credits
    • Peter Ullrich - REPORTER
    • Jonatan Männchen / EEF - ANALYST
    • James Harton - REMEDIATION_DEVELOPER

Affected packages

Hex
ash_authentication

Package

Name
ash_authentication
Purl
pkg:hex/ash_authentication

Affected ranges

Type
SEMVER
Events
Introduced
4.9.1
Fixed
4.15.0
Type
SEMVER
Events
Introduced
5.0.0-rc.0
Fixed
5.0.0-rc.14

Affected versions

4.*
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
4.10.0
4.11.0
4.12.0
4.13.0
4.13.1
4.13.2
4.13.3
4.13.4
4.13.5
4.13.6
4.13.7
4.14.0
4.14.1
4.14.2
5.*
5.0.0-rc.0
5.0.0-rc.1
5.0.0-rc.2
5.0.0-rc.3
5.0.0-rc.4
5.0.0-rc.5
5.0.0-rc.6
5.0.0-rc.7
5.0.0-rc.8
5.0.0-rc.9
5.0.0-rc.10
5.0.0-rc.11
5.0.0-rc.12
5.0.0-rc.13

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-86533.json"
ash_authentication_phoenix

Package

Name
ash_authentication_phoenix
Purl
pkg:hex/ash_authentication_phoenix

Affected ranges

Type
SEMVER
Events
Introduced
2.10.0
Fixed
2.17.4
Type
SEMVER
Events
Introduced
3.0.0-rc.0
Fixed
3.0.0-rc.11

Affected versions

2.*
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.*
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
3.0.0-rc.10

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-86533.json"
Git
github.com/team-alembic/ash_authentication

Affected ranges

Type
GIT
Repo
https://github.com/team-alembic/ash_authentication
Events
Introduced
fcaeb73f76f8f2e9aef8bf637690d2a20dd97596
Fixed
a3f49f758f013d2ff086dd9c5ef2d94e921711b4
Fixed
e28e911caa9728d76329afdb0fb26742ffe4eeef

Affected versions

5.*
5.0.0-rc.8
5.0.0-rc.9
v4.*
v4.10.0
v4.11.0
v4.12.0
v4.13.0
v4.13.1
v4.13.2
v4.13.3
v4.13.4
v4.13.5
v4.13.6
v4.13.7
v4.14.0
v4.14.1
v4.14.2
v4.9.1
v4.9.2
v4.9.3
v4.9.4
v4.9.5
v4.9.6
v4.9.7
v4.9.8
v4.9.9
v5.*
v5.0.0-rc.0
v5.0.0-rc.1
v5.0.0-rc.10
v5.0.0-rc.11
v5.0.0-rc.12
v5.0.0-rc.13
v5.0.0-rc.2
v5.0.0-rc.3
v5.0.0-rc.4
v5.0.0-rc.5
v5.0.0-rc.6
v5.0.0-rc.7

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-86533.json"
github.com/team-alembic/ash_authentication_phoenix

Affected ranges

Type
GIT
Repo
https://github.com/team-alembic/ash_authentication_phoenix
Events
Introduced
a3253fb4fc7145aeb403537af1c24d3a8d51ffb1
Introduced
0135217e34e621dac79ae3d9559aeee49304b0aa
Fixed
f7ab005a2aac09707a25521653c94893d328cc52
Fixed
0135217e34e621dac79ae3d9559aeee49304b0aa

Affected versions

2.*
2.17.0
3.*
3.0.0-rc.3
3.0.0-rc.8
v2.*
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.11.0
v2.12.0
v2.12.1
v2.12.2
v2.13.0
v2.13.1
v2.14.0
v2.14.1
v2.15.0
v2.16.0
v2.17.1
v2.17.2
v2.17.3
v3.*
v3.0.0-rc.0
v3.0.0-rc.1
v3.0.0-rc.10
v3.0.0-rc.3
v3.0.0-rc.4
v3.0.0-rc.6
v3.0.0-rc.7
v3.0.0-rc.9

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-86533.json"