CVE-2026-110826: AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change
team-alembic · ash_authentication
Vendor fix available · Affected: team-alembic ash_authentication · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 42% of scored CVEs
DescriptionCVE.org
Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With apply_on_password_change? true, AshAuthentication.AddOn.LogOutEverywhere.Transformer adds OnPasswordChange to update actions as a global change guarded by where: changing(hashed_password). That condition is evaluated before the action's before_action hooks run, but AshAuthentication.Strategy.Password.HashPasswordChange sets the new hash in a before_action hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's change_password action are both non-atomic. This issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.
Affected products2
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- team-alembic · ash_authenticationfrom 4.5.0 before 4.15.1; from 5.0.0-rc.0 before 5.0.0-rc.16
- team-alembic · ash_authenticationVersions not stated
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- team-alembic
- Published
- November 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-110826 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.