Vulnerability advisory

EEF-CVE-2026-86533

Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

Published Sep 17, 2026Updated Oct 13, 2026OSV record ↗

Also known as CVE-2026-86533GHSA-m6x4-4gvp-xwjr

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected versions

ash_authentication Hex

All ash_authentication advisories →

Affected	Fixed in
`4.9.1` to before 4.15.0	`4.15.0`Advisories →
`5.0.0-rc.0` to before 5.0.0-rc.14	`5.0.0-rc.14`Advisories →
Also listed as affected (37) `4.10.0` `4.11.0` `4.12.0` `4.13.0` `4.13.1` `4.13.2` `4.13.3` `4.13.4` `4.13.5` `4.13.6` `4.13.7` `4.14.0` `4.14.1` `4.14.2` `4.9.1` `4.9.2` `4.9.3` `4.9.4` `4.9.5` `4.9.6` `4.9.7` `4.9.8` `4.9.9` `5.0.0-rc.0` `5.0.0-rc.1` `5.0.0-rc.10` `5.0.0-rc.11` `5.0.0-rc.12` `5.0.0-rc.13` `5.0.0-rc.2` `5.0.0-rc.3` `5.0.0-rc.4` `5.0.0-rc.5` `5.0.0-rc.6` `5.0.0-rc.7` `5.0.0-rc.8` `5.0.0-rc.9`

ash_authentication_phoenix Hex

All ash_authentication_phoenix advisories →

Affected	Fixed in
`2.10.0` to before 2.17.4	`2.17.4`Advisories →
`3.0.0-rc.0` to before 3.0.0-rc.11	`3.0.0-rc.11`Advisories →
Also listed as affected (30) `2.10.0` `2.10.1` `2.10.2` `2.10.3` `2.10.4` `2.10.5` `2.11.0` `2.12.0` `2.12.1` `2.12.2` `2.13.0` `2.13.1` `2.14.0` `2.14.1` `2.15.0` `2.16.0` `2.17.0` `2.17.1` `2.17.2` `2.17.3` `3.0.0-rc.0` `3.0.0-rc.1` `3.0.0-rc.10` `3.0.0-rc.2` `3.0.0-rc.3` `3.0.0-rc.4` `3.0.0-rc.6` `3.0.0-rc.7` `3.0.0-rc.8` `3.0.0-rc.9`

Repository

Affected commits	Fixed by commit
GIT github.com/team-alembic/ash_authentication ↗
fcaeb73f76f8f2e9aef8bf637690d2a20dd97596 to before a3f49f758f013d2ff086dd9c5ef2d94e921711b4	`a3f49f758f013d2ff086dd9c5ef2d94e921711b4`
Not specified	`e28e911caa9728d76329afdb0fb26742ffe4eeef`
Also listed as affected (37) `v4.14.2` `v5.0.0-rc.13` `v4.14.1` `v5.0.0-rc.12` `v5.0.0-rc.11` `v5.0.0-rc.10` `v4.14.0` `v4.13.7` `5.0.0-rc.9` `5.0.0-rc.8` `v5.0.0-rc.7` `v5.0.0-rc.6` `v5.0.0-rc.5` `v5.0.0-rc.4` `v5.0.0-rc.3` `v5.0.0-rc.2` `v5.0.0-rc.1` `v5.0.0-rc.0` `v4.13.6` `v4.13.5` `v4.13.4` `v4.13.3` `v4.13.2` `v4.13.1` `v4.13.0` `v4.12.0` `v4.11.0` `v4.10.0` `v4.9.9` `v4.9.8` `v4.9.7` `v4.9.6` `v4.9.5` `v4.9.4` `v4.9.3` `v4.9.2` `v4.9.1`
GIT github.com/team-alembic/ash_authentication_phoenix ↗
a3253fb4fc7145aeb403537af1c24d3a8d51ffb1 to before f7ab005a2aac09707a25521653c94893d328cc52	`f7ab005a2aac09707a25521653c94893d328cc52`
Not specified	`0135217e34e621dac79ae3d9559aeee49304b0aa`
GIT github.com/team-alembic/ash_authentication_phoenix ↗
0135217e34e621dac79ae3d9559aeee49304b0aa to before f7ab005a2aac09707a25521653c94893d328cc52	`f7ab005a2aac09707a25521653c94893d328cc52`
Not specified	`0135217e34e621dac79ae3d9559aeee49304b0aa`
Also listed as affected (30) `v2.17.3` `v3.0.0-rc.10` `v2.17.2` `v3.0.0-rc.9` `v2.17.1` `3.0.0-rc.8` `2.17.0` `v3.0.0-rc.7` `v2.16.0` `v3.0.0-rc.6` `v3.0.0-rc.4` `v3.0.0-rc.3` `3.0.0-rc.3` `v3.0.0-rc.1` `v2.15.0` `v3.0.0-rc.0` `v2.14.1` `v2.14.0` `v2.13.1` `v2.13.0` `v2.12.2` `v2.12.1` `v2.12.0` `v2.11.0` `v2.10.5` `v2.10.4` `v2.10.3` `v2.10.2` `v2.10.1` `v2.10.0`

Description

Summary

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.

A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.

This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.