CVE Catalog
CVE-2025-4754
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk0.40%
33th percentile - higher than 33% of all known CVEs
Summary
In ash_authentication_phoenix up to version 2.10.0, insufficient session expiration allows session hijacking.
Risk Assessment
An attacker can hijack an authenticated user's session, gaining unauthorized access to the system.
Recommendation
Update ash_authentication_phoenix to version 2.10.0 or later.
Original NVD description (English source)
Insufficient Session Expiration vulnerability in ash-project ash_authentication_phoenix allows Session Hijacking. This vulnerability is associated with program files lib/ash_authentication_phoenix/controller.ex. This issue affects ash_authentication_phoenix until 2.10.0.