CVE-2026-76949

Overview

CVE-2026-76949 is a critical authentication bypass vulnerability in team-alembic ash_authentication. An attacker can hijack a victim’s authenticated session by planting a malicious 'remember-me' cookie. This occurs due to inconsistent session key handling when 'require_token_presence_for_authentication?' is disabled.

Description

Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account. AshAuthentication.Plug.Helpers.sign_in_using_remember_me/3 skips re-authenticating an already-signed-in visitor by checking the session for " _token", but store_in_session/2 writes that key only when require_token_presence_for_authentication? is enabled and otherwise writes the bare subject name. At the default setting the guard therefore reads a key that is never written, its already-signed-in branch is unreachable, and the remember-me sign-in runs on every request through the per-request browser pipeline plug. A planted remember-me cookie is consequently honoured even for a visitor holding a live authenticated session, so whatever the victim enters afterwards lands in data the attacker controls. The read path in authenticate_resource_from_session/4 selects the key correctly, so the guard and the reader disagree about which key holds the session. This issue affects ash_authentication: from 4.10.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Impact

Successful exploitation leads to Confidentiality, Integrity, and Availability compromise. An attacker gains unauthorized access to sensitive information and can perform actions as the victim. This impacts users of applications utilizing the vulnerable versions of ash_authentication. The vulnerability allows session hijacking, potentially leading to account takeover.

Remediation

Upgrade ash_authentication to version 4.15.0 or later, or 5.0.0-rc.14 or later. Verify that 'require_token_presence_for_authentication?' is appropriately configured according to security best practices. Review application session management configurations.

Risk context

This vulnerability is rated Critical with a CVSS v3 score of 7.3 and a CVSS v4 score of 9.1. While an EPSS score is not available, the high CVSS scores indicate a significant risk. Immediate patching or mitigation is recommended.

Affected products

• team-alembic ash_authentication 4.10.0-4.14.9
• team-alembic ash_authentication 5.0.0-rc.0-5.0.0-rc.13