{
  "affected": [
    {
      "database_specific": {
        "source": "https://cna.erlef.org/osv/EEF-CVE-2026-110826.json"
      },
      "package": {
        "ecosystem": "Hex",
        "name": "ash_authentication",
        "purl": "pkg:hex/ash_authentication"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.5.0"
            },
            {
              "fixed": "4.15.1"
            }
          ],
          "type": "SEMVER"
        },
        {
          "events": [
            {
              "introduced": "5.0.0-rc.0"
            },
            {
              "fixed": "5.0.0-rc.16"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": [
        "4.10.0",
        "4.11.0",
        "4.12.0",
        "4.13.0",
        "4.13.1",
        "4.13.2",
        "4.13.3",
        "4.13.4",
        "4.13.5",
        "4.13.6",
        "4.13.7",
        "4.14.0",
        "4.14.1",
        "4.14.2",
        "4.15.0",
        "4.5.0",
        "4.5.1",
        "4.5.2",
        "4.5.3",
        "4.5.4",
        "4.5.5",
        "4.5.6",
        "4.6.0",
        "4.6.1",
        "4.6.2",
        "4.6.3",
        "4.6.4",
        "4.7.0",
        "4.7.1",
        "4.7.2",
        "4.7.3",
        "4.7.4",
        "4.7.5",
        "4.7.6",
        "4.8.0",
        "4.8.1",
        "4.8.2",
        "4.8.3",
        "4.8.5",
        "4.8.6",
        "4.8.7",
        "4.9.0",
        "4.9.1",
        "4.9.2",
        "4.9.3",
        "4.9.4",
        "4.9.5",
        "4.9.6",
        "4.9.7",
        "4.9.8",
        "4.9.9",
        "5.0.0-rc.0",
        "5.0.0-rc.1",
        "5.0.0-rc.10",
        "5.0.0-rc.11",
        "5.0.0-rc.12",
        "5.0.0-rc.13",
        "5.0.0-rc.14",
        "5.0.0-rc.15",
        "5.0.0-rc.2",
        "5.0.0-rc.3",
        "5.0.0-rc.4",
        "5.0.0-rc.5",
        "5.0.0-rc.6",
        "5.0.0-rc.7",
        "5.0.0-rc.8",
        "5.0.0-rc.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://cna.erlef.org/osv/EEF-CVE-2026-110826.json"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0993f944fbd8d668f941d2ca818da4a1d5917641"
            },
            {
              "fixed": "954697f168d55112b5050acddcd936b8bc1fba2b"
            },
            {
              "fixed": "2baef4eddeb604569d3564273d03eeef438e002c"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication",
          "type": "GIT"
        }
      ],
      "versions": [
        "v5.0.0-rc.15",
        "v5.0.0-rc.14",
        "v4.15.0",
        "v4.14.2",
        "v5.0.0-rc.13",
        "v4.14.1",
        "v5.0.0-rc.12",
        "v5.0.0-rc.11",
        "v5.0.0-rc.10",
        "v4.14.0",
        "v4.13.7",
        "5.0.0-rc.9",
        "5.0.0-rc.8",
        "v5.0.0-rc.7",
        "v5.0.0-rc.6",
        "v5.0.0-rc.5",
        "v5.0.0-rc.4",
        "v5.0.0-rc.3",
        "v5.0.0-rc.2",
        "v5.0.0-rc.1",
        "v5.0.0-rc.0",
        "v4.13.6",
        "v4.13.5",
        "v4.13.4",
        "v4.13.3",
        "v4.13.2",
        "v4.13.1",
        "v4.13.0",
        "v4.12.0",
        "v4.11.0",
        "v4.10.0",
        "v4.9.9",
        "v4.9.8",
        "v4.9.7",
        "v4.9.6",
        "v4.9.5",
        "v4.9.4",
        "v4.9.3",
        "v4.9.2",
        "v4.9.1",
        "v4.9.0",
        "v4.8.7",
        "v4.8.5",
        "v4.8.4",
        "v4.8.3",
        "v4.8.2",
        "v4.8.1",
        "v4.8.0",
        "v4.7.7",
        "v4.7.6",
        "v4.7.5",
        "v4.7.4",
        "v4.7.3",
        "v4.7.2",
        "v4.7.1",
        "v4.7.0",
        "v4.6.4",
        "v4.6.3",
        "v4.6.2",
        "v4.6.1",
        "v4.6.0",
        "v4.5.6",
        "v4.5.5",
        "v4.5.4",
        "v4.5.3",
        "v4.5.2",
        "v4.5.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-110826",
    "GHSA-j6f8-qcj9-gh4r"
  ],
  "credits": [
    {
      "name": "azmaveth",
      "type": "FINDER"
    },
    {
      "name": "azmaveth",
      "type": "REPORTER"
    },
    {
      "name": "azmaveth",
      "type": "REMEDIATION_DEVELOPER"
    }
  ],
  "database_specific": {
    "capec_ids": [
      "CAPEC-60"
    ],
    "cpe_ids": [
      "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
      "CWE-1466"
    ]
  },
  "details": "## Summary\n\nImproper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password.\n\nWith `apply_on_password_change? true`, `AshAuthentication.AddOn.LogOutEverywhere.Transformer` adds `OnPasswordChange` to update actions as a global change guarded by `where: changing(hashed_password)`. That condition is evaluated before the action's `before_action` hooks run, but `AshAuthentication.Strategy.Password.HashPasswordChange` sets the new hash in a `before_action` hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's `change_password` action are both non-atomic.\n\nThis issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.\n\n## Configurations\n\nThe `log_out_everywhere` add-on sets `apply_on_password_change? true`, as `mix ash_authentication.install` writes, and the password is changed through a non-atomic update action, which includes the generated password reset action and the installer's `change_password` action. The attacker must already hold one of the victim's session tokens.",
  "id": "EEF-CVE-2026-110826",
  "modified": "2026-11-03T19:41:06.818174804Z",
  "published": "2026-11-03T19:19:26.188Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-j6f8-qcj9-gh4r"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-110826.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/team-alembic/ash_authentication/commit/0993f944fbd8d668f941d2ca818da4a1d5917641"
    },
    {
      "type": "FIX",
      "url": "https://github.com/team-alembic/ash_authentication/commit/954697f168d55112b5050acddcd936b8bc1fba2b"
    },
    {
      "type": "FIX",
      "url": "https://github.com/team-alembic/ash_authentication/commit/2baef4eddeb604569d3564273d03eeef438e002c"
    },
    {
      "type": "PACKAGE",
      "url": "https://hex.pm/packages/ash_authentication"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change"
}