team-alembic ash_authentication/ash_authentication_phoenix Session Validation jti session expiration

Summaryinfo

A vulnerability has been found in team-alembic ash_authentication and ash_authentication_phoenix and classified as critical. Affected by this vulnerability is the function AshAuthentication.Plug.Helpers.authenticate_resource_from_session/AshAuthentication.Phoenix.LiveSession.on_mount/AshAuthentication.TokenResource.Actions.get_token of the component Session Validation. Performing a manipulation of the argument jti results in session expiration. This vulnerability is known as CVE-2026-86533. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as critical has been found in team-alembic ash_authentication and ash_authentication_phoenix (the affected version unknown). This affects the function AshAuthentication.Plug.Helpers.authenticate_resource_from_session/AshAuthentication.Phoenix.LiveSession.on_mount/AshAuthentication.TokenResource.Actions.get_token of the component Session Validation. The manipulation of the argument jti with an unknown input leads to a session expiration vulnerability. CWE is classifying the issue as CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working. This issue affects ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 onward; ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-86533 since 09/11/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/17/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• team-alembic

Name

• ash_authentication
• ash_authentication_phoenix

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion