Description
Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password.

With apply_on_password_change? true, AshAuthentication.AddOn.LogOutEverywhere.Transformer adds OnPasswordChange to update actions as a global change guarded by where: changing(hashed_password). That condition is evaluated before the action's before_action hooks run, but AshAuthentication.Strategy.Password.HashPasswordChange sets the new hash in a before_action hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's change_password action are both non-atomic.

This issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.
Published: 2026-11-03
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: Session Persistence After Credential Change
Action: Patch Immediately
AI Analysis

Impact

The flaw in AshAuthentication prevents proper invalidation of session tokens when a user changes or resets their password. Authentication credentials are updated, but existing session tokens remain active because the logout logic is not invoked for non‑atomic password changes. This oversight allows an attacker who already holds a valid session to continue accessing the account even after the password has been altered, thereby granting unauthorized access.

Affected Systems

The vulnerability impacts the team‑alembic ash_authentication library in the following ranges: all releases from 4.5.0 up to but not including 4.15.1, and from 5.0.0‑rc.0 up to but not including 5.0.0‑rc.16. All earlier versions of the product are affected, while the first patched versions (4.15.1 and 5.0.0‑rc.16) and newer releases contain the fix.

Risk and Exploitability

The issue has a CVSS score of 6.3, indicating moderate severity, and no EPSS score is presently available. It is not listed in the CISA KEV catalog, which suggests no confirmed public exploits. The vulnerability can be leveraged by any entity that can obtain or hijack a session token prior to the user resetting the password, after which the token would remain valid despite the credential change.

Generated by OpenCVE AI on November 3, 2026 at 20:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to ash_authentication 4.15.1 or later, where the logout-on-password‑change bug is fixed.
  • Confirm that the addon AshAuthentication.AddOn.LogOutEverywhere.Transformer is enabled and that apply_on_password_change is set to true, ensuring all password alterations trigger session token revocation.
  • If an immediate upgrade is impossible, force a global logout by clearing or expiring all active sessions post‑password‑reset, using the application's session management API or restart procedures as a temporary mitigation.

Generated by OpenCVE AI on November 3, 2026 at 20:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 03 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Description Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With apply_on_password_change? true, AshAuthentication.AddOn.LogOutEverywhere.Transformer adds OnPasswordChange to update actions as a global change guarded by where: changing(hashed_password). That condition is evaluated before the action's before_action hooks run, but AshAuthentication.Strategy.Password.HashPasswordChange sets the new hash in a before_action hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's change_password action are both non-atomic. This issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.
Title AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change
First Time appeared Team-alembic
Team-alembic ash Authentication
Weaknesses CWE-1466
CPEs cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
Vendors & Products Team-alembic
Team-alembic ash Authentication
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Team-alembic Ash Authentication
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-11-03T19:40:08.522Z

Reserved: 2026-11-03T03:00:02.226Z

Link: CVE-2026-110826

cve-icon Vulnrichment

Updated: 2026-11-03T19:40:03.418Z

cve-icon NVD

Status : Deferred

Published: 2026-11-03T20:18:06.307

Modified: 2026-11-03T20:18:06.440

Link: CVE-2026-110826

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T20:30:12Z

Weaknesses