CVE-2026-110826
Deferred Deferred - Pending Action

Session Fixation in AshAuthentication After Password Change

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: EEF

Description
Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With apply_on_password_change? true, AshAuthentication.AddOn.LogOutEverywhere.Transformer adds OnPasswordChange to update actions as a global change guarded by where: changing(hashed_password). That condition is evaluated before the action's before_action hooks run, but AshAuthentication.Strategy.Password.HashPasswordChange sets the new hash in a before_action hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's change_password action are both non-atomic. This issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-110826
EUVD
EUVD-2026-116148

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
team-alembic ash_authentication 4.5.0
team-alembic ash_authentication 5.0.0-rc.0
team-alembic ash_authentication 0993f944fbd8d668f941d2ca818da4a1d5917641

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-110826 is an improper session invalidation flaw in the AshAuthentication library. When a user changes or resets their password, active session tokens should be revoked to prevent unauthorized access. However, due to a timing issue in the token revocation logic, sessions remain valid even after password changes. This happens because the condition to invalidate sessions is checked before the password hash is updated, leaving existing tokens active.

Impact Analysis

If you use AshAuthentication versions between 4.5.0-4.15.1 or 5.0.0-rc.0-5.0.0-rc.16, an attacker who steals your session token can maintain access to your account even after you change your password. This means unauthorized users could continue using your session indefinitely unless you log out manually from all devices.

Compliance Impact

This vulnerability could violate compliance requirements that mandate prompt revocation of access after credential changes, such as GDPR's data protection principles or HIPAA's access control rules. Unauthorized session persistence after password changes may lead to unauthorized data access, potentially resulting in regulatory penalties or breaches of confidentiality.

Mitigation Strategies

Upgrade AshAuthentication to version 4.15.1 or later for the 4.x branch, or to version 5.0.0-rc.16 or later for the 5.x branch. This ensures proper session invalidation after password changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110826. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...