Executive brief
Guardian is an authentication library used in Elixir/Phoenix applications to manage user sessions and tokens. An attacker can forge a session revocation token without knowing the signing secret, allowing them to log out any user by knowing their session identifier. This enables unauthorized denial-of-service attacks on user sessions, forcing legitimate users to re-authenticate.
Technical details
Guardian.revoke/3 in lib/guardian.ex uses peek/1 to decode JWT tokens, which performs only base64-decoding without cryptographic signature verification. Unlike sibling operations refresh/2 and exchange/4 that call decode_and_verify first, revoke/3 acts directly on unverified claims before passing them to the token module's revoke callback and on_revoke hook (state-mutating operations). An attacker can forge a JWT with known victim identifying claims (jti, sub), sign it with any key, and submit it to endpoints that call Guardian.revoke/3. When the token module mutates state keyed by these claims (e.g., whitelist deletion or blacklist insertion), the victim's legitimate session is evicted. The attack requires no authentication or knowledge of the signing secret. Versions before 2.4.1 are affected.
Affected products
- Erlang Ecosystem Foundation Guardian 1.0.0 before 2.4.1
Timeline
- 2026-08-01: disclosed
- 2026-08-01: patched: Fixed in version 2.4.1