CVE-2026-86533

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working. This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.

• CWE-613

• https://cna.erlef.org/cves/CVE-2026-86533.html
• https://github.com/team-alembic/ash_authentication/commit/a3f49f758f013d2ff086dd9c5ef2d94e921711b4
• https://github.com/team-alembic/ash_authentication/commit/e28e911caa9728d76329afdb0fb26742ffe4eeef
• https://github.com/team-alembic/ash_authentication/commit/fcaeb73f76f8f2e9aef8bf637690d2a20dd97596
• https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-w374-hvrx-66hg
• https://github.com/team-alembic/ash_authentication_phoenix/commit/0135217e34e621dac79ae3d9559aeee49304b0aa
• https://github.com/team-alembic/ash_authentication_phoenix/commit/a3253fb4fc7145aeb403537af1c24d3a8d51ffb1
• https://github.com/team-alembic/ash_authentication_phoenix/commit/f7ab005a2aac09707a25521653c94893d328cc52
• https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-m6x4-4gvp-xwjr
• https://osv.dev/vulnerability/EEF-CVE-2026-86533

Published

Sep 17, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86518A vulnerability has been found in code-projects Student Crud…6.3
• CVE-2026-86519A vulnerability was found in code-projects Student Crud Oper…5.3
• CVE-2026-8652An OS Command Injection vulnerability exists in Aterm. If a …8.5
• CVE-2026-86520Bransys ELD is shipped with hardcoded MQTT credentials, whic…7.5
• CVE-2026-86522Improper Output Neutralization for Logs vulnerability in tea…6.3
• CVE-2026-8653The MasterStudy LMS Pro Plus plugin for WordPress is vulnera…6.5
• CVE-2026-86538knowns versions before 0.30.0 contain a path traversal vulne…7.5
• CVE-2026-86539knowns through 0.33.0 contains a server-side request forgery…7.2
• CVE-2026-8654Improper input validation in Delphix Continuous Data connect…8.7
• CVE-2026-86540knowns versions before 0.30.0 fail to validate the settings.…7.8
• CVE-2026-86541knowns versions before 0.30.0 contain a path traversal vulne…8.3
• CVE-2026-86542knowns before 0.30.0 fails to validate import names in the i…9.1