CVE-2026-82761— Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
Quick assessment
Affected
team-alembic ash_authentication
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
漏洞描述翻译： 在 team-alembic 的 AshAuthentication 中存在一个检查时刻与使用时刻（TOCTOU）竞态条件漏洞。攻击者若持有已泄露的魔法链接，即可重放其“一次性令牌”，从而以目标用户的身份进行认证。 配置为 的魔法链接（默认为开启状态）本应只能被兑换一次。然而，由于没有任何机制对“令牌有效性检查”与“令牌消耗”进行串行化，导致对同一令牌的并发兑换请求全部成功，且每次都会生成一个完整的用户令牌。 具体而言： 登录流程使用 验证 JWT，但撤销操作发生在之后： - 在 回调中执行撤销；
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82761
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
Source: CVE Program / CVE List V5
Vulnerability Description
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with single_use_token?, which is the default, is meant to be redeemable exactly once, but nothing serialises the token's validity check against its consumption, so concurrent redemptions of one token all succeed and each yields a full user token.
Sign-in verifies the JWT with Jwt.verify/4 and revokes it only afterwards: AshAuthentication.Strategy.MagicLink.SignInPreparation revokes in a Query.after_action callback, and AshAuthentication.Strategy.MagicLink.SignInChange in an after_transaction hook that runs once the sign-in has already committed. AshAuthentication.TokenResource.Actions.revoke/3 writes the revocation as an upsert, so a concurrent duplicate revocation silently succeeds instead of conflicting and no request ever loses the race.
This issue affects ash_authentication: from 3.9.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| team-alembic | ash_authentication | 3.9.0 ~ 4.15.0 |
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
|
|
| team-alembic | ash_authentication | cf3d227ef25912cf1b0c5fa80f20001f5c46a102 ~ * |
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-82761
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82761
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-82761 (3)
Same Patch Batch · team-alembic · 2026-09-17 · 14 CVEs total
| CVE-2026-86533 | 9.1 CRITICAL | Revoked session accepted because the session jti is never checked in AshAuthentication and |
| CVE-2026-85500 | 9.1 CRITICAL | `require_confirmed_with` is not enforced on the action and fails open on an unreadable att |
| CVE-2026-88952 | 9.1 CRITICAL | OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentic |
| CVE-2026-91039 | 9.1 CRITICAL | dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing c |
| CVE-2026-82760 | 8.2 HIGH | Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in |
| CVE-2026-82685 | 7.6 HIGH | Confirmation token accepted on any record in AshAuthentication |
| CVE-2026-80218 | 7.6 HIGH | Sign-in token minted for one resource accepted by another in AshAuthentication |
| CVE-2026-81632 | 7.2 HIGH | Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix |
| CVE-2026-78223 | 6.9 MEDIUM | Token revocation record built from unverified JWT claims in AshAuthentication |
| CVE-2026-86522 | 6.3 MEDIUM | Log injection via an unescaped password reset identity in AshAuthentication |
| CVE-2026-81637 | 2.3 LOW | Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication |
| CVE-2026-82723 | 1.8 LOW | Actor record with password digest stored in AshAuthentication audit log entries |
| CVE-2026-82759 | 1.8 LOW | Reversible IP address pseudonymisation in AshAuthentication audit log hash mode |
IV. Related Vulnerabilities
Same product: ash_authentication
-
CVE-2026-91039
dynamic_oidc identities are not namespaced by connection in -
CVE-2026-88952
OAuth2 sign-in attached to an existing account without an em -
CVE-2026-85500
`require_confirmed_with` is not enforced on the action and f -
CVE-2026-86533
Revoked session accepted because the session jti is never ch -
CVE-2026-80218
Sign-in token minted for one resource accepted by another in
Same vendor: team-alembic
-
CVE-2026-91039
dynamic_oidc identities are not namespaced by connection in -
CVE-2026-88952
OAuth2 sign-in attached to an existing account without an em -
CVE-2026-85500
`require_confirmed_with` is not enforced on the action and f -
CVE-2026-86533
Revoked session accepted because the session jti is never ch -
CVE-2026-81632
Single-use sign-in token placed in a redirect query string i
Same weakness: CWE-367
-
CVE-2026-86861
pgAdmin 4: File Manager save_file writes through a symbolic -
CVE-2026-25278
Time-of-check Time-of-use (TOCTOU) Race Condition in Automot -
CVE-2024-11222
Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab -
CVE-2026-91708
Google Chrome 竞争条件问题漏洞 -
CVE-2026-91744
Google Chrome 竞争条件问题漏洞
V. Comments for CVE-2026-82761
No comments yet