The vulnerability stems from AshAuthentication retaining the OAuth2 state value in the session even after a failed callback. Because the stored state survives all failure paths—such as access_denied, an invalid code, token‑exchange errors, or registration failures—the value can be captured and later replayed. An attacker who obtains a victim’s state value can trigger the callback again, causing the victim to be signed into an attacker‑controlled account. The primary impact is the unauthorized use of the victim’s session, effectively allowing account compromise. The weakness is a session expiration oversight, corresponding to CWE‑613.

The issue affects the team‑alembic AshAuthentication library. Versions from 0.6.0 up to but excluding 4.15.0, and the development releases from 5.0.0‑rc.0 up to but excluding 5.0.0‑rc.14, are vulnerable. All other releases are considered safe.

The CVSS score of 2.3 indicates a low severity in the official analysis, yet the attack can be executed with access to the victim’s state value, which is typically issued during the OAuth flow. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a replay of a rejected callback where the attacker provides the victim’s retained state value. Successful exploitation would redirect the victim into an adversary‑controlled account, compromising confidentiality and integrity of that session while leaving availability intact. The fix in later releases deletes the state on any failure path, eliminating the replay window.