---
id: "CVE-2026-110826"
kind: "vulnerability"
aliases: ["CVE-2026-110826"]
title: "Elixir ash_authentication: password change leaves old session tokens valid"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ash-authentication", "ash-framework", "elixir", "package", "phoenix"]
not_affected_if: ["apply-on-password-change-false", "default-config"]
published_at: "2026-11-03T20:18:06+00:00"
first_seen_at: "2026-11-03T20:49:22+00:00"
updated_at: "2026-11-03T20:50:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110826", "first_seen_at": "2026-11-03T20:49:22+00:00"}]
---

# Elixir ash_authentication: password change leaves old session tokens valid

ash_authentication's LogOutEverywhere add-on fails to revoke existing sessions when a user changes or resets their password on non-atomic actions. An attacker who already holds a victim's session token keeps access after the password is changed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `ash_authentication` in `mix.lock` and note the resolved version.
- Check whether `apply_on_password_change?` is set to `true` in the `LogOutEverywhere` add-on configuration.

## Fix

- `ash_authentication` `4.15.1` for the 4.x line
- `ash_authentication` `5.0.0-rc.16` for the 5.0 release candidates

## Timeline

- 2026-11-03T20:49:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110826

## Documents

- [advisory] Vendor advisory: github.com https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-j6f8-qcj9-gh4r
- [fix] Patch: github.com https://github.com/team-alembic/ash_authentication/commit/0993f944fbd8d668f941d2ca818da4a1d5917641
- [fix] Patch: github.com https://github.com/team-alembic/ash_authentication/commit/2baef4eddeb604569d3564273d03eeef438e002c
- [fix] Patch: github.com https://github.com/team-alembic/ash_authentication/commit/954697f168d55112b5050acddcd936b8bc1fba2b

## From the sources

Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password.

With apply_on_password_change? true, AshAuthentication.AddOn.LogOutEverywhere.Transformer adds OnPasswordChange to update actions as a global change guarded by where: changing(hashed_password). That condition is evaluated before the action's before_action hooks run, but AshAuthentication.Strategy.Password.HashPasswordChange sets the new hash in a before_action hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's change_password action are both non-atomic.

This issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_