The vulnerability is a time‑of‑check time‑of‑use race condition in AshAuthentication’s magic‑link flow. Because the token validity check is not serialized with its consumption, an attacker holding a leaked or intercepted magic‑link token can submit multiple concurrent requests that all succeed, each granting a fresh authentication token. This allows the attacker to authenticate as the target user, effectively bypassing intended single‑use restrictions. The weakness is a classic TOCTOU concurrency flaw, identified as CWE‑367.

Vulnerable versions of the AshAuthentication library from team‑a­lembic include releases 3.9.0 up to and including 4.14.x, and releases 5.0.0‑rc.0 through 5.0.0‑rc.13. All other releases, starting at 4.15.0 and 5.0.0‑rc.14, contain the fix.

The CVSS base score of 9.1 indicates high severity, and the lack of a KEV listing suggests no known active exploitation yet. The EPSS score is not available, but the high rating and the nature of the race condition imply a non‑negligible likelihood of exploitation in environments where magic links are used and the token cannot be protected from replay. An attacker would need to obtain a legitimate magic link or token—via interception, phishing, or insider compromise—and then replay it through concurrent requests to succeed.