AIKIDO-2026-308110

TL;DR

In ash_authentication, remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement. is enabled and otherwise writes the bare subject name. At the default setting the guard therefore reads a key that is never written, its already-signed-in branch is unreachable, and the remember-me sign-in runs on every request through the per-request browser pipeline plug.