eef-cve-2026-110826
CVSS 6.3 osv_hex
Description
## Summary Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With `apply_on_password_change? true`, `AshAuthentication.AddOn.LogOutEverywhere.Transformer` adds `OnPasswordChange` to update actions as a global change guarded by `where: changing(hashed_password)`. That condition is evaluated before the action's `before_action` hooks run, but `AshAuthentication.Strategy.Password.HashPasswordChange` sets the new hash in a `before_action` hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's `change_password` action are both non-atomic. This issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16. ## Configurations The `log_out_everywhere` add-on sets `apply_on_password_change? true`, as `mix ash_authentication.install` writes, and the password is changed through a non-atomic update action, which includes the generated password reset action and the installer's `change_password` action. The attacker must already hold one of the victim's session tokens.
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
- https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-j6f8-qcj9-gh4r
- https://cna.erlef.org/cves/CVE-2026-110826.html
- https://github.com/team-alembic/ash_authentication/commit/0993f944fbd8d668f941d2ca818da4a1d5917641
- https://github.com/team-alembic/ash_authentication/commit/954697f168d55112b5050acddcd936b8bc1fba2b
- https://github.com/team-alembic/ash_authentication/commit/2baef4eddeb604569d3564273d03eeef438e002c
- https://hex.pm/packages/ash_authentication
Linked Vulnerabilities
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"source": "https://cna.erlef.org/osv/EEF-CVE-2026-110826.json"
},
"package": {
"ecosystem": "Hex",
"name": "ash_authentication",
"purl": "pkg:hex/ash_authentication"
},
"ranges": [
{
"events": [
{
"introduced": "4.5.0"
},
{
"fixed": "4.15.1"
}
],
"type": "SEMVER"
},
{
"events": [
{
"introduced": "5.0.0-rc.0"
},
{
"fixed": "5.0.0-rc.16"
}
],
"type": "SEMVER"
}
],
"versions": [
"4.10.0",
"4.11.0",
"4.12.0",
"4.13.0",
"4.13.1",
"4.13.2",
"4.13.3",
"4.13.4",
"4.13.5",
"4.13.6",
"4.13.7",
"4.14.0",
"4.14.1",
"4.14.2",
"4.15.0",
"4.5.0",
"4.5.1",
"4.5.2",
"4.5.3",
"4.5.4",
"4.5.5",
"4.5.6",
"4.6.0",
"4.6.1",
"4.6.2",
"4.6.3",
"4.6.4",
"4.7.0",
"4.7.1",
"4.7.2",
"4.7.3",
"4.7.4",
"4.7.5",
"4.7.6",
"4.8.0",
"4.8.1",
"4.8.2",
"4.8.3",
"4.8.5",
"4.8.6",
"4.8.7",
"4.9.0",
"4.9.1",
"4.9.2",
"4.9.3",
"4.9.4",
"4.9.5",
"4.9.6",
"4.9.7",
"4.9.8",
"4.9.9",
"5.0.0-rc.0",
"5.0.0-rc.1",
"5.0.0-rc.10",
"5.0.0-rc.11",
"5.0.0-rc.12",
"5.0.0-rc.13",
"5.0.0-rc.14",
"5.0.0-rc.15",
"5.0.0-rc.2",
"5.0.0-rc.3",
"5.0.0-rc.4",
"5.0.0-rc.5",
"5.0.0-rc.6",
"5.0.0-rc.7",
"5.0.0-rc.8",
"5.0.0-rc.9"
]
},
{
"database_specific": {
"source": "https://cna.erlef.org/osv/EEF-CVE-2026-110826.json"
},
"ranges": [
{
"events": [
{
"introduced": "0993f944fbd8d668f941d2ca818da4a1d5917641"
},
{
"fixed": "954697f168d55112b5050acddcd936b8bc1fba2b"
},
{
"fixed": "2baef4eddeb604569d3564273d03eeef438e002c"
}
],
"repo": "https://github.com/team-alembic/ash_authentication",
"type": "GIT"
}
],
"versions": [
"v5.0.0-rc.15",
"v5.0.0-rc.14",
"v4.15.0",
"v4.14.2",
"v5.0.0-rc.13",
"v4.14.1",
"v5.0.0-rc.12",
"v5.0.0-rc.11",
"v5.0.0-rc.10",
"v4.14.0",
"v4.13.7",
"5.0.0-rc.9",
"5.0.0-rc.8",
"v5.0.0-rc.7",
"v5.0.0-rc.6",
"v5.0.0-rc.5",
"v5.0.0-rc.4",
"v5.0.0-rc.3",
"v5.0.0-rc.2",
"v5.0.0-rc.1",
"v5.0.0-rc.0",
"v4.13.6",
"v4.13.5",
"v4.13.4",
"v4.13.3",
"v4.13.2",
"v4.13.1",
"v4.13.0",
"v4.12.0",
"v4.11.0",
"v4.10.0",
"v4.9.9",
"v4.9.8",
"v4.9.7",
"v4.9.6",
"v4.9.5",
"v4.9.4",
"v4.9.3",
"v4.9.2",
"v4.9.1",
"v4.9.0",
"v4.8.7",
"v4.8.5",
"v4.8.4",
"v4.8.3",
"v4.8.2",
"v4.8.1",
"v4.8.0",
"v4.7.7",
"v4.7.6",
"v4.7.5",
"v4.7.4",
"v4.7.3",
"v4.7.2",
"v4.7.1",
"v4.7.0",
"v4.6.4",
"v4.6.3",
"v4.6.2",
"v4.6.1",
"v4.6.0",
"v4.5.6",
"v4.5.5",
"v4.5.4",
"v4.5.3",
"v4.5.2",
"v4.5.1"
]
}
],
"aliases": [
"CVE-2026-110826",
"GHSA-j6f8-qcj9-gh4r"
],
"credits": [
{
"name": "azmaveth",
"type": "FINDER"
},
{
"name": "azmaveth",
"type": "REPORTER"
},
{
"name": "azmaveth",
"type": "REMEDIATION_DEVELOPER"
}
],
"database_specific": {
"capec_ids": [
"CAPEC-60"
],
"cpe_ids": [
"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
],
"cwe_ids": [
"CWE-1466"
]
},
"details": "## Summary\n\nImproper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password.\n\nWith `apply_on_password_change? true`, `AshAuthentication.AddOn.LogOutEverywhere.Transformer` adds `OnPasswordChange` to update actions as a global change guarded by `where: changing(hashed_password)`. That condition is evaluated before the action's `before_action` hooks run, but `AshAuthentication.Strategy.Password.HashPasswordChange` sets the new hash in a `before_action` hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's `change_password` action are both non-atomic.\n\nThis issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.\n\n## Configurations\n\nThe `log_out_everywhere` add-on sets `apply_on_password_change? true`, as `mix ash_authentication.install` writes, and the password is changed through a non-atomic update action, which includes the generated password reset action and the installer's `change_password` action. The attacker must already hold one of the victim's session tokens.",
"id": "EEF-CVE-2026-110826",
"modified": "2026-11-03T19:41:06.818174804Z",
"published": "2026-11-03T19:19:26.188Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-j6f8-qcj9-gh4r"
},
{
"type": "WEB",
"url": "https://cna.erlef.org/cves/CVE-2026-110826.html"
},
{
"type": "WEB",
"url": "https://github.com/team-alembic/ash_authentication/commit/0993f944fbd8d668f941d2ca818da4a1d5917641"
},
{
"type": "FIX",
"url": "https://github.com/team-alembic/ash_authentication/commit/954697f168d55112b5050acddcd936b8bc1fba2b"
},
{
"type": "FIX",
"url": "https://github.com/team-alembic/ash_authentication/commit/2baef4eddeb604569d3564273d03eeef438e002c"
},
{
"type": "PACKAGE",
"url": "https://hex.pm/packages/ash_authentication"
}
],
"schema_version": "1.9.2",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change"
}