CVE-2025-4754 Details
Description
Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it. This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.
A session hijacking vulnerability has been identified in the ash-project's ash_authentication_phoenix library, affecting versions through 2.9.0. The issue arises from insufficient session expiration, as session tokens remain valid on the server after a user logs out. This creates a security risk, allowing compromised tokens to be used even after logout, and preventing users from fully invalidating their sessions on shared or potentially compromised devices.
Users should upgrade to ash_authentication_phoenix version 2.10.0 or later. After upgrading, it is necessary to update the AuthController implementation to use the new 'clear_session/2' function with the appropriate OTP app name. If the 'require_token_presence_for_authentication?' setting is not enabled, a separate error will occur. As an alternative, tokens can be manually revoked in the 'logout/2' handler of the auth controller.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 17, 2025CISA-ADP
Assessed Jun 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | EEF |
Affected Products
| Product | Versions |
|---|---|
| ash-project ash_authentication_phoenix | All versions |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | EEF |
| Jul 24, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | CVE Modified | EEF |
| Jul 4, 2025 | CVE Modified | EEF |
| Jun 17, 2025 | New CVE Received | EEF |