Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-86688— Session id is not renewed on authentication in ash_authentication, allowing session fixation

Quick assessment

Affected
team-alembic ash_authentication
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

中的 存在会话固定漏洞：能够向受害者浏览器中植入会话标识符的攻击者，可以导致受害者在登录后保持一个已认证的会话。 通过 将认证主体写入现有会话，但从未调用 ，因此访问者带入的会话标识符会延续到其认证后的会话中。所有认证事件都会经过这一个函数：由 注入的默认 、由 生成的 ，以及基于 remember-me 的自动登录。 是对该函数的 。 登出时也不会关闭这个“窗口”，因为 以 结尾，它清除了会话内容，但保留了标识符，因此植入的标识符在“登出-再登录”周期中依然存活。 该问题影响 的以下版本：0.2.0 至 4.15

CVSS 7.4 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86688

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Session id is not renewed on authentication in ash_authentication, allowing session fixation
Source: CVE Program / CVE List V5
Vulnerability Description
Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session with Plug.Conn.put_session/3 and never calls Plug.Conn.configure_session(renew: true), so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default success/4 injected by AshAuthentication.Phoenix.Controller.__using__/1, the AuthController emitted by mix ash_authentication_phoenix.install, and remember-me auto-login. AshAuthentication.Phoenix.Plug.store_in_session/2 is a defdelegate to it. Logout does not close the window either, because clear_session/2 ends with Plug.Conn.clear_session/1, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle. This issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
会话固定
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
team-alembic ash_authentication 0.2.0 ~ 4.15.0 cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
team-alembic ash_authentication a939dde9b917c072cdf10c4b0913a9886a4b0231 ~ * cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-86688

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86688

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-86688 (2)

Other References for CVE-2026-86688 (3)

Same Patch Batch · team-alembic · 2026-09-17 · 16 CVEs total

CVE-2026-82761 9.1 CRITICAL Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
CVE-2026-86533 9.1 CRITICAL Revoked session accepted because the session jti is never checked in AshAuthentication and
CVE-2026-85500 9.1 CRITICAL `require_confirmed_with` is not enforced on the action and fails open on an unreadable att
CVE-2026-88952 9.1 CRITICAL OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentic
CVE-2026-91039 9.1 CRITICAL dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing c
CVE-2026-76949 9.1 CRITICAL Remember-me sign-in guard reads a session key that is never written in ash_authentication,
CVE-2026-82760 8.2 HIGH Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
CVE-2026-82685 7.6 HIGH Confirmation token accepted on any record in AshAuthentication
CVE-2026-80218 7.6 HIGH Sign-in token minted for one resource accepted by another in AshAuthentication
CVE-2026-81632 7.2 HIGH Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
CVE-2026-78223 6.9 MEDIUM Token revocation record built from unverified JWT claims in AshAuthentication
CVE-2026-86522 6.3 MEDIUM Log injection via an unescaped password reset identity in AshAuthentication
CVE-2026-81637 2.3 LOW Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication
CVE-2026-82723 1.8 LOW Actor record with password digest stored in AshAuthentication audit log entries
CVE-2026-82759 1.8 LOW Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

IV. Related Vulnerabilities

Same product: ash_authentication
Same vendor: team-alembic
Same weakness: CWE-384

V. Comments for CVE-2026-86688

No comments yet

Leave a comment