CVE-2026-78223— Token revocation record built from unverified JWT claims in AshAuthentication
Quick assessment
Affected
team-alembic ash_authentication
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
AshAuthentication 中存在一个不当验证加密签名的漏洞，允许调用令牌撤销操作的一方使撤销失效，或向令牌资源写入任意行数据。 具体而言， 函数会读取 参数，并通过 对其进行解码。该函数委托给 执行，不进行签名验证（与 不同）。它返回的 、 和 声明值会被直接写入撤销记录，仅受 这一条件保护。由于 字段派生自攻击者指定的 声明，攻击者可以构造一个伪造的令牌副本：保留真实的 但将 回溯到过去时间。这将导致生成的撤销记录本身已过期，随后 会将其删除，使得原本应被撤销的合法令牌再次通过 检查。此外，攻击者还可通
Possible ATT&CK Techniques 3 AI
T1562.001 T1557 · Adversary-in-the-Middle T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78223
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Token revocation record built from unverified JWT claims in AshAuthentication
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource.
AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the :token argument and decodes it with AshAuthentication.Jwt.peek/1, which delegates to Joken.peek_claims/1 and performs no signature check, unlike Jwt.verify/4. The jti, exp and sub claims it returns are written straight onto the revocation record, guarded only by byte_size(token) > 0. Because expires_at derives from the attacker-chosen exp, a forged copy of a genuine token that keeps the real jti but backdates exp yields a revocation row that is already expired: expunge_expired removes it and the genuine token passes revoked? again. Arbitrary jti and sub values can be inserted the same way.
This issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
密码学签名的验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| team-alembic | ash_authentication | 0.2.0 ~ 4.15.0 |
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
|
|
| team-alembic | ash_authentication | a939dde9b917c072cdf10c4b0913a9886a4b0231 ~ * |
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-78223
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78223
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-78223 (2)
Vendor Advisories for CVE-2026-78223 (3)
Same Patch Batch · team-alembic · 2026-09-17 · 14 CVEs total
| CVE-2026-82761 | 9.1 CRITICAL | Magic link single-use tokens replayable via TOCTOU race in AshAuthentication |
| CVE-2026-86533 | 9.1 CRITICAL | Revoked session accepted because the session jti is never checked in AshAuthentication and |
| CVE-2026-85500 | 9.1 CRITICAL | `require_confirmed_with` is not enforced on the action and fails open on an unreadable att |
| CVE-2026-88952 | 9.1 CRITICAL | OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentic |
| CVE-2026-91039 | 9.1 CRITICAL | dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing c |
| CVE-2026-82760 | 8.2 HIGH | Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in |
| CVE-2026-82685 | 7.6 HIGH | Confirmation token accepted on any record in AshAuthentication |
| CVE-2026-80218 | 7.6 HIGH | Sign-in token minted for one resource accepted by another in AshAuthentication |
| CVE-2026-81632 | 7.2 HIGH | Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix |
| CVE-2026-86522 | 6.3 MEDIUM | Log injection via an unescaped password reset identity in AshAuthentication |
| CVE-2026-81637 | 2.3 LOW | Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication |
| CVE-2026-82723 | 1.8 LOW | Actor record with password digest stored in AshAuthentication audit log entries |
| CVE-2026-82759 | 1.8 LOW | Reversible IP address pseudonymisation in AshAuthentication audit log hash mode |
IV. Related Vulnerabilities
Same product: ash_authentication
-
CVE-2026-91039
dynamic_oidc identities are not namespaced by connection in -
CVE-2026-88952
OAuth2 sign-in attached to an existing account without an em -
CVE-2026-85500
`require_confirmed_with` is not enforced on the action and f -
CVE-2026-86533
Revoked session accepted because the session jti is never ch -
CVE-2026-80218
Sign-in token minted for one resource accepted by another in
Same vendor: team-alembic
-
CVE-2026-91039
dynamic_oidc identities are not namespaced by connection in -
CVE-2026-88952
OAuth2 sign-in attached to an existing account without an em -
CVE-2026-85500
`require_confirmed_with` is not enforced on the action and f -
CVE-2026-86533
Revoked session accepted because the session jti is never ch -
CVE-2026-81632
Single-use sign-in token placed in a redirect query string i
Same weakness: CWE-347
-
CVE-2026-92718
Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass vi -
CVE-2026-42784
Sequoia-openpgp: sequoia-openpgp: cryptographic integrity co -
CVE-2026-86585
Improper Verification of the Firmware Signature vulnerabilit -
CVE-2026-86109
Security Advisory 0182 -
CVE-2026-58200
@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinar
V. Comments for CVE-2026-78223
No comments yet