CVE-2026-78223 Details
Description
Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the :token argument and decodes it with AshAuthentication.Jwt.peek/1, which delegates to Joken.peek_claims/1 and performs no signature check, unlike Jwt.verify/4. The jti, exp and sub claims it returns are written straight onto the revocation record, guarded only by byte_size(token) > 0. Because expires_at derives from the attacker-chosen exp, a forged copy of a genuine token that keeps the real jti but backdates exp yields a revocation row that is already expired: expunge_expired removes it and the genuine token passes revoked? again. Arbitrary jti and sub values can be inserted the same way. This issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
A vulnerability exists in the AshAuthentication library by team-alembic, specifically in versions 0.2.0 prior to 4.15.0 and 5.0.0-rc.0 prior to 5.0.0-rc.14. This vulnerability allows a caller to the token revocation action to either nullify a revocation or insert arbitrary data into the token resource. The issue arises because the revocation process relies on unverified JSON Web Token (JWT) claims. The 'RevokeTokenChange.change/3' function decodes the token without checking its signature, using 'AshAuthentication.Jwt.peek/1', which in turn calls 'Joken.peek_claims/1'. This oversight enables an attacker to manipulate the 'exp' claim, creating a revocation record that is already expired, thus bypassing the revocation process.
Users can upgrade to AshAuthentication version 4.15.0 or 5.0.0-rc.14, both of which include the necessary fix. For those unable to upgrade immediately, it is recommended to set 'require_token_presence_for_authentication?' to true, which helps mitigate the impact by breaking authentication for tokens that have been revoked.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-78223.html | EEF | Advisory |
| https://github.com/team-alembic/ash_authentication/commit/344cebb12faf68e648d3283394073ba0c0f78459 | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/commit/a939dde9b917c072cdf10c4b0913a9886a4b0231 | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/commit/eb86353fe5a547c5ff5fd9af0e2c212518c31c9b | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-mfwg-5cpf-px58 | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-78223 | EEF | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | EEF |
Affected Products
| Product | Versions |
|---|---|
| team-alembic AshAuthentication | >= 0.2.0, <= 4.14.2 (semver) >= 5.0.0-rc.0, <= 5.0.0-rc.13 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | EEF |