{"id":"CVE-2026-110826","kind":"vulnerability","aliases":["CVE-2026-110826"],"related":[],"title":"Elixir ash_authentication: password change leaves old session tokens valid","description":"Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password.\n\nWith apply_on_password_change? true, AshAuthentication.AddOn.LogOutEverywhere.Transformer adds OnPasswordChange to update actions as a global change guarded by where: changing(hashed_password). That condition is evaluated before the action's before_action hooks run, but AshAuthentication.Strategy.Password.HashPasswordChange sets the new hash in a before_action hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's change_password action are both non-atomic.\n\nThis issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.","summary":"ash_authentication's LogOutEverywhere add-on fails to revoke existing sessions when a user changes or resets their password on non-atomic actions. An attacker who already holds a victim's session token keeps access after the password is changed.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ash-authentication","ash-framework","elixir","package","phoenix"],"not_affected_if":["apply-on-password-change-false","default-config"],"how_to_check":"- Look for `ash_authentication` in `mix.lock` and note the resolved version.\n- Check whether `apply_on_password_change?` is set to `true` in the `LogOutEverywhere` add-on configuration.","fix":"- `ash_authentication` `4.15.1` for the 4.x line\n- `ash_authentication` `5.0.0-rc.16` for the 5.0 release candidates","status":"open","published_at":"2026-11-03T20:18:06+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","triaged_at":"2026-11-03T20:50:33+00:00","updated_at":"2026-11-03T20:50:33+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T20:50:33Z","model":"claude-haiku-5-5","output":{"fix":"- `ash_authentication` `4.15.1` for the 4.x line\n- `ash_authentication` `5.0.0-rc.16` for the 5.0 release candidates","reach":"internet","title":"Elixir ash_authentication: password change leaves old session tokens valid","impact":"medium","summary":"ash_authentication's LogOutEverywhere add-on fails to revoke existing sessions when a user changes or resets their password on non-atomic actions. An attacker who already holds a victim's session token keeps access after the password is changed.","audience":"developers","category":"package","nicknames":[],"who_cares":["elixir","ash-framework","ash-authentication","phoenix"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker with a stolen session token keeps account access after password reset","analyst_note":"","how_to_check":"- Look for `ash_authentication` in `mix.lock` and note the resolved version.\n- Check whether `apply_on_password_change?` is set to `true` in the `LogOutEverywhere` add-on configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","apply-on-password-change-false"],"who_is_affected":"Applications using ash_authentication from 4.5.0 before 4.15.1, or 5.0.0-rc.0 before 5.0.0-rc.16, that enable the LogOutEverywhere add-on with apply_on_password_change? set to true. The flaw affects non-atomic password change and reset actions, including the generated reset action and the installer's change_password action. Applications without that add-on enabled are not affected by this specific flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4385,"output_tokens":604,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110826':13A,16A '-2026':12A,15A '4.15.1':194C '4.5.0':192C '5.0.0':197C,200C 'access':62B 'action':50B,114C,131C,134C,146C,173C,180C 'add':31B,110C 'add-on':30B 'affect':188C 'alemb':79C 'allow':82C 'alreadi':54B 'appli':104C 'ash':2A,18B,21B,26B,80C,189C 'ash-authent':17B 'ash-framework':20B 'ashauthentication.addon.logouteverywhere.transformer':109C 'ashauthentication.strategy.password.hashpasswordchange':138C 'atom':49B,153C,185C 'attack':52B,84C 'authent':3A,19B,27B,72C,81C,190C 'chang':5A,41B,67B,74C,100C,107C,118C,122C,155C,178C 'condit':126C,157C 'credenti':73C 'cve':11A,14A 'elixir':1A,23B 'evalu':128C 'everi':150C 'exist':36B 'fail':33B 'fals':159C 'framework':22B 'generat':170C 'global':117C 'guard':119C 'hash':123C,142C 'hold':55B,85C 'hook':135C,147C 'improp':68C 'instal':176C 'invalid':70C 'issu':187C 'keep':61B 'leav':6A 'logouteverywher':29B 'new':141C 'non':48B,152C,184C 'non-atom':47B,151C,183C 'old':7A 'onpasswordchang':111C 'packag':24B 'password':4A,45B,65B,102C,106C,124C,154C,171C,179C 'phoenix':25B 'rc.0':198C 'rc.16':201C 'reset':43B,98C,172C 'revok':35B,168C 'run':136C 'session':8A,37B,59B,69C,89C 'set':139C 'sign':93C 'stay':92C 'store':164C 'team':78C 'team-alemb':77C 'token':9A,60B,90C,165C 'true':108C 'updat':113C 'user':40B,162C 'valid':10A 'victim':57B,87C,97C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Applications using ash_authentication from 4.5.0 before 4.15.1, or 5.0.0-rc.0 before 5.0.0-rc.16, that enable the LogOutEverywhere add-on with apply_on_password_change? set to true. The flaw affects non-atomic password change and reset actions, including the generated reset action and the installer's change_password action. Applications without that add-on enabled are not affected by this specific flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ashauthentication","ashframework","elixir","medium","package","phoenix"],"campaign_type":null,"first_public_at":"2026-11-03T18:57:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110826","severity":null,"published_at":"2026-11-03T20:18:06+00:00","modified_at":"2026-11-03T20:18:06+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","fetched_at":"2026-11-03T20:49:22+00:00","note":null}],"documents":[{"id":60561,"url":"https://github.com/team-alembic/ash_authentication/commit/0993f944fbd8d668f941d2ca818da4a1d5917641","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60562,"url":"https://github.com/team-alembic/ash_authentication/commit/2baef4eddeb604569d3564273d03eeef438e002c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60563,"url":"https://github.com/team-alembic/ash_authentication/commit/954697f168d55112b5050acddcd936b8bc1fba2b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60564,"url":"https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-j6f8-qcj9-gh4r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T18:57:34+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}