The vulnerability is an insufficient session expiration flaw that permits a session cookie to remain valid after a user logs out. This flaw allows an attacker who obtains a valid session token to continue using the session, effectively enabling session hijacking. The weakness is classified as CWE‑613, which indicates improper removal or invalidation of a credential after its intended use.

The flaw affects the Ash Authentication Phoenix library from the Ash Project. All releases up to and including version 2.10.0 are impacted. Organizations using this library in any environment—web or otherwise—are at risk unless the software is upgraded beyond version 2.10.0.

The CVSS score of 2.3 reflects a low severity as the vulnerability does not directly lead to remote code execution or full system compromise. The EPSS score of less than 1 % indicates a very low probability of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. In practice, an attacker would need to acquire a valid session cookie, possibly through another vulnerability, to exploit the flaw. Once in possession of the cookie, the attacker can replay the session after logout, underscoring the importance of proper session invalidation.