Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-86533 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working. This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.

Metrics

CVSS 3.x Severity and Vector Strings:

NDDVolerionCVSS-B:4.8 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://cna.erlef.org/cves/CVE-2026-86533.html EEFAdvisoryVendor
https://github.com/team-alembic/ash_authentication/commit/a3f49f758f013d2ff086dd9c5ef2d94e921711b4 EEFSource CodeVendor
https://github.com/team-alembic/ash_authentication/commit/e28e911caa9728d76329afdb0fb26742ffe4eeef EEFSource CodeVendor
https://github.com/team-alembic/ash_authentication/commit/fcaeb73f76f8f2e9aef8bf637690d2a20dd97596 EEFSource CodeVendor
https://github.com/team-alembic/ash_authentication_phoenix/commit/0135217e34e621dac79ae3d9559aeee49304b0aa EEFSource CodeVendor

see all 10 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-613Insufficient Session ExpirationEEF

Affected Products

ProductVersions
team-alembic AshAuthentication
>= 4.9.1, < 4.15.0 (semver)
>= 5.0.0-rc.0, < 5.0.0-rc.14 (semver)

CPE

  • No CPEs found in CPE dictionary for this product.

Remediation

  • Upgrade: 4.15.0moderate effort
  • Upgrade: 5.0.0-rc.14moderate effort
  • Workaround:low effort

    Set `require_token_presence_for_authentication?` to `true`. This will cause the read path to query the token resource and correctly reject revoked sessions.

team-alembic AshAuthentication Phoenix
>= 2.10.0, < 2.17.4 (semver)
>= 3.0.0-rc.0, < 3.0.0-rc.11 (semver)

CPE

  • No CPEs found in CPE dictionary for this product.

Remediation

  • Upgrade: 2.17.4moderate effort
  • Upgrade: 3.0.0-rc.11moderate effort
  • Workaround:low effort

    Set `require_token_presence_for_authentication?` to `true`. This will cause the read path to query the token resource and correctly reject revoked sessions.

Change History

2 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-86533
NVD Published Date:
Sep 17, 2026
NVD Last Modified:
Sep 18, 2026
Source:
EEF
CVE-2026-86533 Details - Not Deferred