Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account.
AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored session_params through a rebinding step inside its with chain, conn <- delete_session(conn, session_key). Elixir evaluates the else block in the scope enclosing the with, so every failure path (the provider returning ?error=access_denied, an invalid code, a token-exchange error, or a registration or sign-in failure) reaches store_authentication_result/2 holding the original connection and the session entry is never removed. The value the module's own comment describes as protection against a CSRF-related attack is therefore consumed only when authentication succeeds, and survives a cancelled or failed attempt until the next request phase or session expiry.
This issue affects ash_authentication: from 0.6.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
" }, { "base64": false, "type": "text/markdown", "value": "Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 `state` value to replay the callback and sign that victim into an attacker-controlled account.\n\n`AshAuthentication.Strategy.OAuth2.Plug.callback/2` clears the stored `session_params` through a rebinding step inside its `with` chain, `conn <- delete_session(conn, session_key)`. Elixir evaluates the `else` block in the scope enclosing the `with`, so every failure path (the provider returning `?error=access_denied`, an invalid code, a token-exchange error, or a registration or sign-in failure) reaches `store_authentication_result/2` holding the original connection and the session entry is never removed. The value the module's own comment describes as protection against a CSRF-related attack is therefore consumed only when authentication succeeds, and survives a cancelled or failed attempt until the next request phase or session expiry.\n\nThis issue affects ash_authentication: from 0.6.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14." } ], "value": "Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account.\n\nAshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored session_params through a rebinding step inside its with chain, conn <- delete_session(conn, session_key). Elixir evaluates the else block in the scope enclosing the with, so every failure path (the provider returning ?error=access_denied, an invalid code, a token-exchange error, or a registration or sign-in failure) reaches store_authentication_result/2 holding the original connection and the session entry is never removed. The value the module's own comment describes as protection against a CSRF-related attack is therefore consumed only when authentication succeeds, and survives a cancelled or failed attempt until the next request phase or session expiry.\n\nThis issue affects ash_authentication: from 0.6.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14." } ], "impacts": [ { "capecId": "CAPEC-60", "descriptions": [ { "lang": "en", "value": "CAPEC-60 Reusing Session IDs (aka Session Replay)" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 2.3, "baseSeverity": "LOW", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-613", "description": "CWE-613 Insufficient Session Expiration", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-17T13:09:06.571Z" }, "references": [ { "tags": [ "vendor-advisory", "related" ], "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-3vcj-gxx8-3p44" }, { "name": "EEF CNA record for CVE-2026-81637", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-81637.html" }, { "name": "OSV record EEF-CVE-2026-81637", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-81637" }, { "name": "Introducing commit c5f5890 in team-alembic/ash_authentication", "tags": [ "related" ], "url": "https://github.com/team-alembic/ash_authentication/commit/c5f589058e04239263f50a1430eb17ea6d5dd1a2" }, { "name": "Fix commit bd43523 in team-alembic/ash_authentication", "tags": [ "patch" ], "url": "https://github.com/team-alembic/ash_authentication/commit/bd4352303bc9d72d007f6818775267585a4bcc2f" }, { "name": "Fix commit d7f939c in team-alembic/ash_authentication", "tags": [ "patch" ], "url": "https://github.com/team-alembic/ash_authentication/commit/d7f939cd02bd618bcaa304631846fa75ffc419d7" } ], "source": { "discovery": "INTERNAL" }, "title": "Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication" }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-09-17T18:26:48.969731Z", "id": "CVE-2026-81637", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T18:26:58.389Z" } } ] } }