CVE-2026-86533

published 2026-09-17

CVE-2026-86533: Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully…

Priority P3 54 critical 9.1 CVSS 4.0

AV N AC L AT P PR N UI N VC H VI H VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.

A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as :. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.

This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
team-alembic	ash_authentication	>= 4.9.1 < 4.15.0	4.15.0
team-alembic	ash_authentication	>= 5.0.0-rc.0 < 5.0.0-rc.14	5.0.0-rc.14
team-alembic	ash_authentication	>= fcaeb73f76f8f2e9aef8bf637690d2a20dd97596 < *	*
team-alembic	ash_authentication_phoenix	>= 0135217e34e621dac79ae3d9559aeee49304b0aa < *	*
team-alembic	ash_authentication_phoenix	>= 2.10.0 < 2.17.4	2.17.4
team-alembic	ash_authentication_phoenix	>= 3.0.0-rc.0 < 3.0.0-rc.11	3.0.0-rc.11
team-alembic	ash_authentication_phoenix	>= a3253fb4fc7145aeb403537af1c24d3a8d51ffb1 < *	*

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-613