Executive brief
AshAuthentication is a library that manages user login flows in web applications, including passwordless "magic link" sign-in. A race condition in the single-use token validation allows an attacker to exploit a leaked magic link by submitting it multiple times simultaneously—each concurrent request will succeed and grant a valid session, bypassing the intended single-use restriction.
Technical details
This is a time-of-check time-of-use (TOCTOU) race condition in the magic link token validation logic. The vulnerability exists because token verification (JWT.verify/4) and token revocation are not atomically serialized: verification happens first, then revocation is deferred to after-action or after-transaction callbacks. An attacker holding a leaked magic link can send concurrent sign-in requests; since the revocation logic uses an upsert operation that silently succeeds on duplicates, all concurrent requests validate the same token before any revocation takes effect, each yielding a valid session. Affects ash_authentication versions 3.9.0–4.14.x and 5.0.0-rc.0–5.0.0-rc.13; patches are available in 4.15.0+ and 5.0.0-rc.14+.
Affected products
- team-alembic AshAuthentication 3.9.0 before 4.15.0 and 5.0.0-rc.0 before 5.0.0-rc.14
Timeline
- 2026-09-17: disclosed