AIKIDO-2026-314106
ash_authentication_phoenix is vulnerable to Insufficient Session Expiration
91
Critical Risk
This Affects:
ash_authentication_phoenixTL;DR
In ash_authentication_phoenix, revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix. A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as jti>:subject>.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ash_authentication_phoenix is vulnerable to Insufficient Session Expiration in versions 2.10.0 - 2.17.3.
How to fix this
Upgrade the ash_authentication_phoenix library to the patch version.
Links
CVE Details
github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-m6x4-4gvp-xwjrgithub.com/team-alembic/ash_authentication/security/advisories/GHSA-w374-hvrx-66hgFix Commits
github.com/team-alembic/ash_authentication/commit/a3f49f758f013d2ff086dd9c5ef2d94e921711b4github.com/team-alembic/ash_authentication/commit/e28e911caa9728d76329afdb0fb26742ffe4eeefgithub.com/team-alembic/ash_authentication/commit/fcaeb73f76f8f2e9aef8bf637690d2a20dd97596github.com/team-alembic/ash_authentication_phoenix/commit/0135217e34e621dac79ae3d9559aeee49304b0aagithub.com/team-alembic/ash_authentication_phoenix/commit/a3253fb4fc7145aeb403537af1c24d3a8d51ffb1github.com/team-alembic/ash_authentication_phoenix/commit/f7ab005a2aac09707a25521653c94893d328cc52
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.