CVE-2026-86533: Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.
A resource configured with sessionidentifier :jti and requiretokenpresenceforauthentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticateresourcefromsession/4 and AshAuthentication.Phoenix.LiveSession.onmount/4 both split the value with splitidentifier/2, discard the jti and pass the bare subject to AshAuthentication.subjecttouser/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.gettoken/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.
This issue affects ashauthenticationphoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 onward; ashauthentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash_authentication_phoenixto a version that resolves this vulnerability.Fixed in 2.17.4 - Upgrade
Upgrade
ash_authentication_phoenixto a version that resolves this vulnerability.Fixed in 3.0.0-rc.0 - Upgrade
Upgrade
ash_authenticationto a version that resolves this vulnerability.Fixed in 4.15.0 - Upgrade
Upgrade
ash_authenticationto a version that resolves this vulnerability.Fixed in 5.0.0-rc.14
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when a resource uses session_identifier :jti and has require_token_presence_for_authentication? disabled. Both AshAuthentication Plug-based authentication and AshAuthentication Phoenix LiveSession authentication are affected under that configuration.
What does an attacker need to exploit it?
An attacker needs a session value captured before that session is signed out or revoked. They can continue presenting that session because authentication uses the subject portion and does not validate the associated jti revocation record.
Are sessions protected when token presence is required for authentication?
The described flaw is in the configuration where require_token_presence_for_authentication? is disabled. When the token-presence branch is used, it checks the token with the jti and user purpose.
Which versions should be remediated?
For ash_authentication_phoenix, upgrade from affected 2.x releases to 2.17.4 or later, and avoid affected releases from 3.0.0-rc.0 onward. For ash_authentication, upgrade from affected 4.x releases to 4.15.0 or later, and avoid affected releases from 5.0.0-rc.0 before 5.0.0-rc.14.