Vulnerability advisory

EEF-CVE-2025-4754

Missing Session Revocation on Logout in ash_authentication_phoenix

Published Jun 17, 2025Updated Sep 22, 2026OSV record ↗

Also known as CVE-2025-4754GHSA-f7gq-h8jv-h3cq

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected versions

ash_authentication_phoenix Hex

All ash_authentication_phoenix advisories →

Affected Fixed in

0.1.0 to before 2.10.0 2.10.0Advisories →

Affected	Fixed in
`0.1.0` to before 2.10.0	`2.10.0`Advisories →
Also listed as affected (83) `1.0.0` `1.0.1` `1.1.0` `1.2.0` `1.3.0` `1.3.1` `1.4.0` `1.4.1` `1.4.2` `1.4.3` `1.4.4` `1.4.5` `1.4.6` `1.4.7` `1.4.8` `1.5.0` `1.5.1` `1.6.0` `1.6.1` `1.6.2` `1.6.3` `1.6.4` `1.6.5` `1.6.6` `1.7.0` `1.7.1` `1.7.2` `1.7.3` `1.8.0` `1.8.1` `1.8.2` `1.8.3` `1.8.4` `1.8.5` `1.8.6` `1.8.7` `1.9.0` `1.9.1` `1.9.2` `1.9.3` `1.9.4` `2.0.0` `2.0.0-rc.0` `2.0.0-rc.1` `2.0.0-rc.2` `2.0.1` `2.0.2` `2.1.0` `2.1.1` `2.1.10` `2.1.11` `2.1.2` `2.1.3` `2.1.4` `2.1.5` `2.1.6` `2.1.7` `2.1.8` `2.1.9` `2.2.0` `2.2.1` `2.3.0` `2.4.0` `2.4.1` `2.4.2` `2.4.3` `2.4.4` `2.4.5` `2.4.6` `2.4.7` `2.4.8` `2.5.0` `2.5.1` `2.5.2` `2.5.3` `2.5.4` `2.6.0` `2.6.1` `2.6.2` `2.6.3` `2.7.0` `2.8.0` `2.9.0`

Also listed as affected (83)

Repository

Affected commits	Fixed by commit
GIT github.com/team-alembic/ash_authentication_phoenix ↗
05ab4f438bf0cd0fdfb279d912bbe0d2c3620e02 to before a3253fb4fc7145aeb403537af1c24d3a8d51ffb1	`a3253fb4fc7145aeb403537af1c24d3a8d51ffb1`
Also listed as affected (84) `v2.9.0` `v2.7.0` `v2.6.3` `v2.6.2` `v2.6.1` `v2.6.0` `v2.5.4` `v2.5.3` `v2.5.2` `v2.5.1` `v2.5.0` `v2.4.8` `v2.4.7` `v2.4.6` `v2.4.5` `v2.4.4` `v2.4.3` `v2.4.2` `v2.4.1` `v2.4.0` `v2.3.0` `v2.2.1` `v2.2.0` `v2.1.11` `v2.1.10` `v2.1.9` `v2.1.8` `v2.1.7` `v2.1.6` `v2.1.5` `v2.1.4` `v2.1.3` `v2.1.2` `v2.1.1` `v2.1.0` `v2.0.2` `v2.0.1` `v2.0.0` `v2.0.0-rc.3` `v2.0.0-rc.2` `v2.0.0-rc.1` `v2.0.0-rc.0` `v1.9.4` `v1.9.2` `v1.9.1` `v1.9.0` `v1.8.7` `v1.8.6` `v1.8.5` `v1.8.4` `v1.8.3` `v1.8.2` `v1.8.1` `v1.8.0` `v1.7.3` `v1.7.2` `v1.7.1` `v1.7.0` `v1.6.6` `v1.6.4` `v1.6.2` `v1.6.1` `v1.6.0` `v1.5.0` `v1.4.8` `v1.4.7` `v1.4.6` `v1.4.5` `v1.4.4` `v1.4.3` `v1.4.2` `v1.4.1` `v1.4.0` `v1.3.1` `v1.3.0` `v1.2.0` `v1.1.0` `v1.0.1` `v1.0.0` `v0.5.0` `v0.4.0` `v0.3.0` `v0.2.0` `v0.1.0`

Description

Summary

Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards.

The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it.

This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.