team-alembic ash_authentication up to 0.2.0/4.14.x/5.0.0-rc.0/5.0.0-rc.13 Session AshAuthentication.Plug.Helpers.store_in_session session fixiation

Summaryinfo

A vulnerability was found in team-alembic ash_authentication up to 0.2.0/4.14.x/5.0.0-rc.0/5.0.0-rc.13. It has been rated as critical. This impacts the function AshAuthentication.Plug.Helpers.store_in_session of the component Session Handler. Performing a manipulation results in session fixiation. This vulnerability is known as CVE-2026-86688. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in team-alembic ash_authentication up to 0.2.0/4.14.x/5.0.0-rc.0/5.0.0-rc.13. This affects the function AshAuthentication.Plug.Helpers.store_in_session of the component Session Handler. The manipulation with an unknown input leads to a session fixiation vulnerability. CWE is classifying the issue as CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session with Plug.Conn.put_session/3 and never calls Plug.Conn.configure_session(renew: true), so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default success/4 injected by AshAuthentication.Phoenix.Controller.__using__/1, the AuthController emitted by mix ash_authentication_phoenix.install, and remember-me auto-login. AshAuthentication.Phoenix.Plug.store_in_session/2 is a defdelegate to it. Logout does not close the window either, because clear_session/2 ends with Plug.Conn.clear_session/1, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle. This issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-86688 since 09/17/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 4.15.0 or 5.0.0-rc.14 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• team-alembic

Name

• ash_authentication

Version

• 0.1
• 0.2.0
• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 5.0.0-rc
• 5.0.0-rc.0
• 5.0.0-rc.1
• 5.0.0-rc.2
• 5.0.0-rc.3
• 5.0.0-rc.4
• 5.0.0-rc.5
• 5.0.0-rc.6
• 5.0.0-rc.7
• 5.0.0-rc.8
• 5.0.0-rc.9
• 5.0.0-rc.10
• 5.0.0-rc.11
• 5.0.0-rc.12
• 5.0.0-rc.13

Website

• Product: https://github.com/team-alembic/ash_authentication/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion