CVE-2026-86688 Details
Description
Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session with Plug.Conn.put_session/3 and never calls Plug.Conn.configure_session(renew: true), so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default success/4 injected by AshAuthentication.Phoenix.Controller.__using__/1, the AuthController emitted by mix ash_authentication_phoenix.install, and remember-me auto-login. AshAuthentication.Phoenix.Plug.store_in_session/2 is a defdelegate to it. Logout does not close the window either, because clear_session/2 ends with Plug.Conn.clear_session/1, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle. This issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
A session fixation vulnerability exists in the Team-Alembic Ash_Authentication library. This issue allows an attacker to take over a user's authenticated session by planting a session identifier in the user's browser before they log in. The vulnerability arises because the library's session management does not properly renew the session identifier upon authentication, allowing the attacker to hijack the session once the user signs in. This flaw is present in versions 0.2.0 prior to 4.15.0 and in the 5.0.0 release candidate series prior to 5.0.0-rc.14.
Upgrade to Ash_Authentication version 4.15.0 or 5.0.0-rc.14. After upgrading, the session management will properly renew the session identifier during authentication, preventing fixation attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-86688.html | EEF | AdvisoryRemedy |
| https://github.com/team-alembic/ash_authentication/commit/3e1d452cbf1564e87f5f97be882b66fe25af7cfa | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/commit/872db454405ecad4fcdabd9ff3d8755d1d6a69ae | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/commit/a939dde9b917c072cdf10c4b0913a9886a4b0231 | EEF | Source CodeVendor |
| https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-v577-944g-7h3x | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-86688 | EEF | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-384 | Session Fixation | EEF |
Affected Products
| Product | Versions |
|---|---|
| team-alembic ash_authentication | >= 0.2.0, <= 4.14.2 (semver) >= 5.0.0-rc.0, <= 5.0.0-rc.13 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | EEF |