Description
Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards.

The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it.

This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.
Published: 2025-06-17
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-18506 ash_authentication_phoenix has Insufficient Session Expiration
Github GHSA Github GHSA GHSA-f7gq-h8jv-h3cq ash_authentication_phoenix has Insufficient Session Expiration
History

Tue, 22 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
Description Insufficient Session Expiration vulnerability in ash-project ash_authentication_phoenix allows Session Hijacking. This vulnerability is associated with program files lib/ash_authentication_phoenix/controller.ex. This issue affects ash_authentication_phoenix until 2.10.0. Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it. This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.
References

Mon, 06 Apr 2026 16:45:00 +0000

Type Values Removed Values Added
References

Tue, 02 Sep 2025 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Team-alembic
Team-alembic ash Authentication Phoenix
CPEs cpe:2.3:a:team-alembic:ash_authentication_phoenix:*:*:*:*:*:*:*:*
Vendors & Products Team-alembic
Team-alembic ash Authentication Phoenix

Sat, 12 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00153}

 epss

{'score': 0.00192}

Fri, 04 Jul 2025 09:30:00 +0000

Type Values Removed Values Added
References

Tue, 17 Jun 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 17 Jun 2025 14:45:00 +0000

Type Values Removed Values Added
Description Insufficient Session Expiration vulnerability in ash-project ash_authentication_phoenix allows Session Hijacking. This vulnerability is associated with program files lib/ash_authentication_phoenix/controller.ex. This issue affects ash_authentication_phoenix until 2.10.0.
Title Missing Session Revocation on Logout in ash_authentication_phoenix
Weaknesses CWE-613
References
Metrics cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Team-alembic Ash Authentication Phoenix
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-22T09:23:20.437Z

Reserved: 2025-05-15T09:03:11.355Z

Link: CVE-2025-4754

cve-icon Vulnrichment

Updated: 2025-06-17T14:40:40.526Z

cve-icon NVD

Status : Deferred

Published: 2025-06-17T15:15:53.273

Modified: 2026-09-22T10:17:08.407

Link: CVE-2025-4754

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T10:30:17Z

Weaknesses
  • CWE-613

    Insufficient Session Expiration