CVE-2026-86688: Session id is not renewed on authentication in ash_authentication, allowing session fixation
Session Fixation vulnerability in team-alembic ashauthentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in.
AshAuthentication.Plug.Helpers.storeinsession/2 writes the authenticated subject into the existing session with Plug.Conn.putsession/3 and never calls Plug.Conn.configuresession(renew: true), so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default success/4 injected by AshAuthentication.Phoenix.Controller.using/1, the AuthController emitted by mix ashauthenticationphoenix.install, and remember-me auto-login. AshAuthentication.Phoenix.Plug.storeinsession/2 is a defdelegate to it. Logout does not close the window either, because clearsession/2 ends with Plug.Conn.clearsession/1, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle.
This issue affects ashauthentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
team-alembic/ash_authenticationto a version that resolves this vulnerability.Fixed in 4.15.0 - Upgrade
Upgrade
team-alembic/ash_authenticationto a version that resolves this vulnerability.Fixed in 5.0.0-rc.14
Event History
Frequently Asked Questions
Which authentication paths are affected?
All authentication events that use the shared session helper are affected, including the default success/4 callback, the AuthController generated by mix ash_authentication_phoenix.install, remember-me auto-login, and AshAuthentication.Phoenix.Plug.store_in_session/2.
What must an attacker do to exploit this issue?
The attacker must be able to plant a session identifier in the victim's browser before the victim authenticates. If the victim then signs in, the existing identifier remains associated with the authenticated session, allowing the attacker to retain access through that session.
Does logging out invalidate a planted session identifier?
No. The logout path clears session contents but does not renew or invalidate the session identifier, so a planted identifier can survive a logout-then-login cycle.
Which versions need remediation?
Affected versions are ash_authentication 0.2.0 through versions before 4.15.0, and 5.0.0-rc.0 through versions before 5.0.0-rc.14. Upgrading to 4.15.0 or 5.0.0-rc.14, as applicable, remediates the affected version ranges.