CVE-2026-82761: Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be redeemable exactly once, but nothing serialises the token's validity check against its consumption, so concurrent redemptions of one token all succeed and each yields a full user token.
Sign-in verifies the JWT with Jwt.verify/4 and revokes it only afterwards: AshAuthentication.Strategy.MagicLink.SignInPreparation revokes in a Query.afteraction callback, and AshAuthentication.Strategy.MagicLink.SignInChange in an aftertransaction hook that runs once the sign-in has already committed. AshAuthentication.TokenResource.Actions.revoke/3 writes the revocation as an upsert, so a concurrent duplicate revocation silently succeeds instead of conflicting and no request ever loses the race.
This issue affects ashauthentication: from 3.9.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash_authenticationto a version that resolves this vulnerability.Fixed in 4.15.0 - Upgrade
Upgrade
ash_authenticationto a version that resolves this vulnerability.Fixed in 5.0.0-rc.14 - Operational
Rotate/replace any magic link single-use tokens that may have been issued before upgrading, since leaked/replayed tokens could authenticate as the target subject.
Event History
Frequently Asked Questions
Which releases are affected?
Affected releases are ash_authentication 3.9.0 through versions before 4.15.0, and 5.0.0-rc.0 through versions before 5.0.0-rc.14. Upgrade to 4.15.0 or later in the 4.x line, or to 5.0.0-rc.14 or later in the 5.0 release-candidate line.
Is a non-default magic-link configuration required for exposure?
No. The affected single_use_token? setting is enabled by default, so deployments using the standard single-use magic-link behavior are exposed.
What must an attacker have to exploit this issue?
The attacker must possess a leaked magic link for the target subject and submit concurrent redemption requests before its revocation is recorded. Each concurrent redemption can succeed and issue a full user token.