Is CVE-2026-78223 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78223 being exploited in the wild.

How severe is CVE-2026-78223?

Informational severity, with a CVSS score of 7.5, published 17 September 2026.

Which products and versions are affected?

team-alembic AshAuthentication 0.2.0 to 4.14.x, 5.0.0-rc.0 to 5.0.0-rc.13.

Is there a fix for CVE-2026-78223?

A patch was published on 2026-09-17: Patched in versions 4.15.0 and 5.0.0-rc.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78223 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-78223?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78223: team-alembic AshAuthentication token revocation signature verification bypass

CVE-2026-78223 · Severity: info · CVSS 7.5 · Published 2026-09-17

AshAuthentication is a library used to handle user authentication and token management in Elixir applications. A vulnerability in the token revocation feature allows attackers to forge token revocation records by manipulating JWT claims without cryptographic verification, enabling them to neutralize legitimate revocations or insert fraudulent token records. This could allow attackers to bypass token revocation controls and maintain unauthorized access to applications.

Quick answers

Is CVE-2026-78223 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78223 being exploited in the wild.
How severe is CVE-2026-78223?: Informational severity, with a CVSS score of 7.5, published 17 September 2026.
Which products and versions are affected?: team-alembic AshAuthentication 0.2.0 to 4.14.x, 5.0.0-rc.0 to 5.0.0-rc.13.
Is there a fix for CVE-2026-78223?: A patch was published on 2026-09-17: Patched in versions 4.15.0 and 5.0.0-rc.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78223 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-78223?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from improper cryptographic signature verification in AshAuthentication.TokenResource.RevokeTokenChange.change/3. The function decodes JWT tokens using Joken.peek_claims/1 (which returns claims without signature verification) instead of calling Jwt.verify/4 (which performs verification). An attacker can craft a forged JWT with a valid jti (JWT ID) but a backdated exp (expiration time) claim, causing the revocation record to appear already expired and be automatically removed by expunge_expired. Similarly, arbitrary jti and sub (subject) claims can be injected. The attack requires network access to the token revocation endpoint but no pre-existing authentication. Versions 0.2.0 through 4.14.x and 5.0.0-rc.0 through 5.0.0-rc.13 are affected; patched versions are 4.15.0 and 5.0.0-rc.14 or later.

Affected products

team-alembic AshAuthentication 0.2.0 to 4.14.x, 5.0.0-rc.0 to 5.0.0-rc.13

Timeline

2026-09-17: disclosed
2026-09-17: patched: Patched in versions 4.15.0 and 5.0.0-rc.14

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.