EEF-CVE-2026-86688
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-86688.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-86688.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-86688
- Aliases
-
- CVE-2026-86688
- GHSA-v577-944g-7h3x
- Published
- 2026-09-17T21:58:00Z
- Modified
- 2026-09-17T22:11:00Z
- Severity
-
- 7.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Session id is not renewed on authentication in ash_authentication, allowing session fixation
- Details
-
Summary
Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in.
AshAuthentication.Plug.Helpers.store_in_session/2writes the authenticated subject into the existing session withPlug.Conn.put_session/3and never callsPlug.Conn.configure_session(renew: true), so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the defaultsuccess/4injected byAshAuthentication.Phoenix.Controller.__using__/1, theAuthControlleremitted bymix ash_authentication_phoenix.install, and remember-me auto-login.AshAuthentication.Phoenix.Plug.store_in_session/2is adefdelegateto it. Logout does not close the window either, becauseclear_session/2ends withPlug.Conn.clear_session/1, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle.This issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Impact
An attacker holding a session identifier they planted before the victim signed in gains that victim's authenticated session, and with it full account takeover, in deployments using a server-side session store.
Workarounds
Call
Plug.Conn.configure_session(conn, renew: true)in your ownsuccess/4beforestore_in_session/2. This is a one-line change in application code and closes the controller sign-in path, though not remember-me auto-login, which does not pass through application code.Add
Plug.Conn.configure_session(conn, drop: true)at sign-out so a planted identifier does not survive a logout-then-login cycle.Configurations
Exploitation for account takeover requires a server-side session store (ETS, Mnesia, Redis or a database), where the cookie carries a stable session identifier, and a position from which the attacker can plant that cookie in the victim's browser: cookie tossing from a sibling subdomain, an HTTP host without HSTS, or a shared or kiosk browser.
Phoenix defaults to the signed cookie store, and neither package's installer changes it. Under that store the authenticated session lives in the re-signed cookie delivered only to the victim, so a planted pre-authentication copy does not become an authenticated session. Attacker-planted session contents, such as a
return_tovalue, still survive into the authenticated session there. - Database specific
{ "capec_ids": [ "CAPEC-61" ], "cpe_ids": [ "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*" ], "cwe_ids": [ "CWE-384" ] }- References
-
- https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-v577-944g-7h3x
- https://cna.erlef.org/cves/CVE-2026-86688.html
- https://github.com/team-alembic/ash_authentication/commit/a939dde9b917c072cdf10c4b0913a9886a4b0231
- https://github.com/team-alembic/ash_authentication/commit/872db454405ecad4fcdabd9ff3d8755d1d6a69ae
- https://github.com/team-alembic/ash_authentication/commit/3e1d452cbf1564e87f5f97be882b66fe25af7cfa
- https://hex.pm/packages/ash_authentication
- Credits
-
-
- Peter Ullrich - REPORTER
-
- James Harton - REMEDIATION_DEVELOPER
-
- Jonatan Männchen / EEF - COORDINATOR
-
Affected packages
Hex / ash_authentication
Package
- Name
- ash_authentication
- Purl
- pkg:hex/ash_authentication
Affected ranges
- Type
- SEMVER
- Events
-
Introduced0.2.0Fixed4.15.0
- Type
- SEMVER
- Events
-
Introduced5.0.0-rc.0Fixed5.0.0-rc.14