CVE-2026-865339.1CriticalCWE-613

CVE-2026-86533: Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

team-alembic · ash_authentication

Vendor fix available · Affected: team-alembic ash_authentication · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.9%probability of exploitation in the next 30 days

60th percentile

050100

Higher than 60% of scored CVEs

9.1CriticalCVSS 4.0

LowMediumHighCrit.

DescriptionCVE.org

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working. This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.

Affected products4

From the CVE record. A product or version that is not listed is unknown, not unaffected.

team-alembic · ash_authenticationfrom 4.9.1 before 4.15.0; from 5.0.0-rc.0 before 5.0.0-rc.14
team-alembic · ash_authenticationVersions not stated
team-alembic · ash_authentication_phoenixfrom 2.10.0 before 2.17.4; from 3.0.0-rc.0 before 3.0.0-rc.11
team-alembic · ash_authentication_phoenixVersions not stated

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: CWE-613 · Authentication
Vendor: team-alembic
Published: September 2026
Band: Unlikely (under 1%), September 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-86533 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.