Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-86533: AshAuthentication and AshAuthentication Phoenix keep signed‑out sessions active
CVE-2026-86533 · published 24 days ago
Summary
If your application uses AshAuthentication or AshAuthentication Phoenix, a user who signs out can still stay logged in because the system does not check that the session has been revoked. This means a captured session cookie could be reused even after logout. Update to the latest versions of these libraries as soon as possible to ensure sign‑out properly ends the session.
What to do
- Update team-alembic ash_authentication to version e28e911caa9728d76329afdb0fb26742ffe4eeef.
- Update ash-project ash_authentication_phoenix to version 2.17.4.
- Update ash-project ash_authentication to version 5.0.0-rc.14.
- Update ash_authentication to version 5.0.0-rc.14.
- Update ash_authentication_phoenix to version 3.0.0-rc.11.
- Update team-alembic ash_authentication_phoenix to version 0135217e34e621dac79ae3d9559aeee49304b0aa.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | team-alembic | ash_authentication_phoenix |
< 2.17.4 < f7ab005a2aac09707a25521653c94893d328cc52 < * Fix: upgrade to 0135217e34e621dac79ae3d9559aeee49304b0aa
|
| – | team-alembic | ash_authentication |
< 4.15.0 < * Fix: upgrade to e28e911caa9728d76329afdb0fb26742ffe4eeef
|
| Hex | ash-project | ash_authentication_phoenix |
>= 3.0.0-rc.0, < 2.17.4 Fix: upgrade to 2.17.4
|
| Hex | ash-project | ash_authentication |
>= 5.0.0-rc.0, < 5.0.0-rc.14 Fix: upgrade to 5.0.0-rc.14
|
| Hex | – | ash_authentication |
>= 5.0.0-rc.0, < 5.0.0-rc.14 Fix: upgrade to 5.0.0-rc.14
|
| Hex | – | ash_authentication_phoenix |
>= 3.0.0-rc.0, < 3.0.0-rc.11 Fix: upgrade to 3.0.0-rc.11
|
Original advisory text
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.
A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.
This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.
A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.
This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-86533 Vendor Advisory
- https://github.com/team-alembic/ash_authentication Product
- https://github.com/team-alembic/ash_authentication_phoenix Product
- https://osv.dev/vulnerability/EEF-CVE-2026-86533
- https://cna.erlef.org/cves/CVE-2026-86533.html
- https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-w374...
- https://github.com/team-alembic/ash_authentication/commit/fcaeb73f76f8f2e9aef8bf...
- https://hex.pm/packages/ash_authentication_phoenix Product
- https://hex.pm/packages/ash_authentication Product
- https://github.com/team-alembic/ash_authentication_phoenix/commit/a3253fb4fc7145...
- https://github.com/team-alembic/ash_authentication_phoenix/commit/f7ab005a2aac09...
- https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/G...
- https://github.com/team-alembic/ash_authentication/commit/a3f49f758f013d2ff086dd...
- https://github.com/team-alembic/ash_authentication/commit/e28e911caa9728d76329af...
- https://github.com/team-alembic/ash_authentication_phoenix/commit/0135217e34e621...
- https://github.com URL
- https://repo.hex.pm URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86533... Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-613Insufficient Session Expiration
Timeline
Published17 Sep 2026
Updated9 Oct 2026
First seen17 Sep 2026
Sources
CVE-2026-86533 · NVD
CVE-2026-86533 · MITRE
EEF-CVE-2026-86533 · OSV
GHSA-m6x4-4gvp-xwjr · GHSA
CVE-2026-86533 · OSV
Track software like this
Free during beta