Executive brief
ash_authentication is an Elixir library that handles user login and session management. A vulnerability allows an attacker who plants a fake "remember-me" cookie in a victim's browser to hijack that victim's authenticated session and impersonate them, gaining full access to the victim's account and data. The flaw exists due to a mismatch in how the library checks for existing sessions, making the security check ineffective under default settings.
Technical details
The vulnerability is an authentication bypass caused by a logic error in AshAuthentication.Plug.Helpers.sign_in_using_remember_me/3. The function checks for an existing session by looking for a key that is only written when require_token_presence_for_authentication? is enabled, but at default settings this key is never written—only the bare subject name is stored. As a result, the already-signed-in check is unreachable, and the remember-me sign-in logic runs on every request. An attacker can plant a malicious remember-me cookie that will be honored even for victims with active authenticated sessions, allowing session hijacking. The read path authenticate_resource_from_session/4 uses the correct key, creating a critical disagreement between the guard logic and the reader. No authentication is required from the attacker beyond cookie planting (via XSS, network sniffing, or similar mechanisms).
Affected products
- team-alembic ash_authentication 4.10.0 to 4.15.0 (exclusive) and 5.0.0-rc.0 to 5.0.0-rc.14 (exclusive)
Timeline
- 2026-09-17: disclosed
- other: CVE-2026-76949 assigned