AIKIDO-2026-90931
ash_authentication is vulnerable to Race Condition (TOCTOU)
91
Critical Risk
This Affects:
ash_authenticationTL;DR
In ash_authentication, magic link single-use tokens replayable through TOCTOU race in AshAuthentication. AshAuthentication.TokenResource.Actions.revoke/3 writes the revocation as an upsert, so a concurrent duplicate revocation silently succeeds instead of conflicting and no request ever loses the race.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ash_authentication is vulnerable to Race Condition (TOCTOU) in versions 3.9.0 - 4.14.2.
How to fix this
Upgrade the ash_authentication library to the patch version.
Links
Fix Commits
github.com/team-alembic/ash_authentication/commit/18dfdb36c14aa6a61df8572bce2d5ec36b1d9840github.com/team-alembic/ash_authentication/commit/9ef6864b8833d3b795427a7b8dc518a4997d41abgithub.com/team-alembic/ash_authentication/commit/cf3d227ef25912cf1b0c5fa80f20001f5c46a102
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.