CVE-2026-91039

A vulnerability in the ash_authentication library (Elixir) allows an attacker who can plant a remember-me cookie in a victim's browser to replace the victim's authenticated session with one for the attacker's own account. The issue stems from a mismatch between the session keys used by the guard and the reader, causing remember-me sign-in to run on every request.

In ash_authentication there is an improper authentication vulnerability that allows an attacker to sign in as another user by linking their OAuth2 identity to an account that is not theirs. The attacker can attach a verified email to an account matched on other attributes, leading to session hijacking.

In team-alembic ash_authentication with apply_on_password_change enabled, the password change condition is evaluated before the new hash is set in a before_action hook, so stored tokens are not revoked for non-atomic password changes. An attacker holding a victim's session token stays signed in after the victim resets or changes their password.

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.

The ash_authentication library (team-alembic project) contains an improper restriction of excessive authentication attempts vulnerability, allowing an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies add brute_force_strategy preparation only to the actions they generate, so when a resource defines its own action the limit is not applied; additionally, with registration_enabled? true the OTP sign-in is a create action on which preparations do not run. The issue affects versions from 5.0.0-rc.4 before 5.0.0-rc.16.

Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session with Plug.Conn.put_session/3 and never calls Plug.Conn.configure_session(renew: true), so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default success/4 injected by AshAuthentication.Phoenix.Controller.__using__/1, the AuthController emitted by mix ash_authentication_phoenix.install, and remember-me auto-login. AshAuthentication.Phoenix.Plug.store_in_session/2 is a defdelegate to it. Logout does not close the window either, because clear_session/2 ends with Plug.Conn.clear_session/1, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle. This issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.