AIKIDO-2026-105155
ash_authentication is vulnerable to Session Fixation
74
High Risk
This Affects:
ash_authenticationTL;DR
In ash_authentication, session id is not renewed on authentication in ash_authentication, allowing session fixation. Every authentication event reaches this one function: the default success/4 injected by AshAuthentication.Phoenix.Controller.__using__/1, the AuthController emitted by mix ash_authentication_phoenix.install, and remember-me auto-login. AshAuthentication.Phoenix.Plug.store_in_session/2 is a defdelegate to it.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ash_authentication is vulnerable to Session Fixation in versions 0.2.0 - 4.14.2.
How to fix this
Upgrade the ash_authentication library to the patch version.
Links
Fix Commits
github.com/team-alembic/ash_authentication/commit/3e1d452cbf1564e87f5f97be882b66fe25af7cfagithub.com/team-alembic/ash_authentication/commit/872db454405ecad4fcdabd9ff3d8755d1d6a69aegithub.com/team-alembic/ash_authentication/commit/a939dde9b917c072cdf10c4b0913a9886a4b0231
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.