Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81637— Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

Quick assessment

Affected
team-alembic ash_authentication
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

团队 Alembic 中 存在会话过期不足的漏洞。该漏洞允许攻击者在获取到受害者的 OAuth2 值后，重放回调请求，将受害者登录到攻击者控制的账户。 技术细节 会在其 链中的重绑定步骤中清除已存储的 ： 由于 Elixir 中 的 块在封闭 的作用域内执行，因此所有失败路径（例如： 服务商返回 无效的授权码 令牌交换错误 注册或登录失败 ）都会到达 ，此时仍持有原始连接，而会话条目从未被删除。 模块自身注释中将该机制描述为针对 CSRF 相关攻击的防护措施。然而，该保护仅在认证成功时才会被消耗；若认证被取消或失败

CVSS 2.3 · Low

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81637

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication
Source: CVE Program / CVE List V5
Vulnerability Description
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored session_params through a rebinding step inside its with chain, conn <- delete_session(conn, session_key). Elixir evaluates the else block in the scope enclosing the with, so every failure path (the provider returning ?error=access_denied, an invalid code, a token-exchange error, or a registration or sign-in failure) reaches store_authentication_result/2 holding the original connection and the session entry is never removed. The value the module's own comment describes as protection against a CSRF-related attack is therefore consumed only when authentication succeeds, and survives a cancelled or failed attempt until the next request phase or session expiry. This issue affects ash_authentication: from 0.6.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
team-alembic ash_authentication 0.6.0 ~ 4.15.0 cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
team-alembic ash_authentication c5f589058e04239263f50a1430eb17ea6d5dd1a2 ~ * cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-81637

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81637

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-81637 (2)

Vendor Advisories for CVE-2026-81637 (3)

Same Patch Batch · team-alembic · 2026-09-17 · 14 CVEs total

CVE-2026-82761 9.1 CRITICAL Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
CVE-2026-86533 9.1 CRITICAL Revoked session accepted because the session jti is never checked in AshAuthentication and
CVE-2026-85500 9.1 CRITICAL `require_confirmed_with` is not enforced on the action and fails open on an unreadable att
CVE-2026-88952 9.1 CRITICAL OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentic
CVE-2026-91039 9.1 CRITICAL dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing c
CVE-2026-82760 8.2 HIGH Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
CVE-2026-82685 7.6 HIGH Confirmation token accepted on any record in AshAuthentication
CVE-2026-80218 7.6 HIGH Sign-in token minted for one resource accepted by another in AshAuthentication
CVE-2026-81632 7.2 HIGH Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
CVE-2026-78223 6.9 MEDIUM Token revocation record built from unverified JWT claims in AshAuthentication
CVE-2026-86522 6.3 MEDIUM Log injection via an unescaped password reset identity in AshAuthentication
CVE-2026-82723 1.8 LOW Actor record with password digest stored in AshAuthentication audit log entries
CVE-2026-82759 1.8 LOW Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

IV. Related Vulnerabilities

Same product: ash_authentication
Same vendor: team-alembic
Same weakness: CWE-613

V. Comments for CVE-2026-81637

No comments yet

Leave a comment