Description
Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards.
The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it.
This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| team-alembic | ash_authentication_phoenix | 0.1.0 – < 2.10.0 | 2.10.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Hex | ash_authentication_phoenix | >= 0.1.0, < 2.10.0 | 2.10.0 | EEF-CVE-2025-4754 |
| Hex | ash_authentication_phoenix | < 2.10.0 | 2.10.0 | GHSA-f7gq-h8jv-h3cq |
References
- https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-f7gq-h8jv-h3cq vendor-advisory related
- EEF CNA record for CVE-2025-4754 related
- OSV record EEF-CVE-2025-4754 related
- https://github.com/team-alembic/ash_authentication_phoenix/pull/634 patch
- Introducing commit 05ab4f4 in team-alembic/ash_authentication_phoenix related
- Fix commit a3253fb in team-alembic/ash_authentication_phoenix patch