AIKIDO-2026-665381

TL;DR

In ash_authentication, replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored session_params through a rebinding step inside its with chain, conn - delete_session(conn, session_key). The value the module's own comment describes as protection against a CSRF-related attack is therefore consumed only when authentication succeeds, and survives a cancelled or failed attempt until the next request phase or session expiry.