CVE-2026-86688

Overview

CVE-2026-86688 is a session fixation vulnerability affecting the `team-alembic ash_authentication` library. An attacker can potentially hijack a user's authenticated session by pre-setting a session identifier. This vulnerability stems from the library's failure to renew session identifiers upon successful authentication or logout.

Description

Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session with Plug.Conn.put_session/3 and never calls Plug.Conn.configure_session(renew: true), so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default success/4 injected by AshAuthentication.Phoenix.Controller.__using__/1, the AuthController emitted by mix ash_authentication_phoenix.install, and remember-me auto-login. AshAuthentication.Phoenix.Plug.store_in_session/2 is a defdelegate to it. Logout does not close the window either, because clear_session/2 ends with Plug.Conn.clear_session/1, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle. This issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Impact

Successful exploitation could lead to Confidentiality, Integrity, and Availability compromise as an attacker gains unauthorized access to a legitimate user's account. This impacts users of applications utilizing the vulnerable versions of `ash_authentication`. The severity is considered high, potentially allowing full account takeover.

Remediation

Upgrade `ash_authentication` to version 4.15.0 or later, or 5.0.0-rc.14 or later. Ensure applications are configured to properly renew session identifiers upon authentication and logout. Review application code for custom session handling that might bypass the library’s intended behavior.

Risk context

This vulnerability has a CVSS v3 score of 8.8 (High) and a CVSS v4 score of 7.4. While an EPSS score is not available, the high CVSS scores indicate a significant risk that should be addressed promptly.

Affected products

• team-alembic ash_authentication < 4.15.0
• team-alembic ash_authentication 5.0.0-rc.0 < 5.0.0-rc.14