Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.4

Ash Authentication allows attacker to keep session after login

CVE-2026-86688 · published 24 days ago
Summary

Web applications that use ash_authentication may let an attacker plant a session ID in a victim's browser and keep that ID after the victim signs in. The session identifier is not refreshed on login or logout, so the attacker can stay authenticated even after the user logs out and logs back in. Update ash_authentication to version 4.15.0 or later (or 5.0.0‑rc.14 or later) to resolve the issue, and ensure session IDs are regenerated on each login.

What to do
  • Update team-alembic ash_authentication to version 3e1d452cbf1564e87f5f97be882b66fe25af7cfa.
  • Update ash-project ash_authentication to version 5.0.0-rc.14.
  • Update ash_authentication to version 5.0.0-rc.14.
Affected software
Ecosystem VendorProductAffected versions
– team-alembic ash_authentication < 4.15.0
< *
Fix: upgrade to 3e1d452cbf1564e87f5f97be882b66fe25af7cfa
Hex ash-project ash_authentication >= 5.0.0-rc.0, < 5.0.0-rc.14
Fix: upgrade to 5.0.0-rc.14
Hex – ash_authentication >= 5.0.0-rc.0, < 5.0.0-rc.14
Fix: upgrade to 5.0.0-rc.14
Original advisory text
Session id is not renewed on authentication in ash_authentication, allowing session fixation
Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in.

AshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session with Plug.Conn.put_session/3 and never calls Plug.Conn.configure_session(renew: true), so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default success/4 injected by AshAuthentication.Phoenix.Controller.__using__/1, the AuthController emitted by mix ash_authentication_phoenix.install, and remember-me auto-login. AshAuthentication.Phoenix.Plug.store_in_session/2 is a defdelegate to it. Logout does not close the window either, because clear_session/2 ends with Plug.Conn.clear_session/1, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle.

This issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-384Session Fixation
Timeline
Published17 Sep 2026
Updated11 Oct 2026
First seen17 Sep 2026
Sources
CVE-2026-86688 · NVD
CVE-2026-86688 · MITRE
EEF-CVE-2026-86688 · OSV
GHSA-v577-944g-7h3x · GHSA
CVE-2026-86688 · OSV
Track software like this
Free during beta