CVE-2026-65633: AshAuthentication Vulnerability Allows Replay of Purpose-Limited JWTs as Full Bearer Credentials
Summary
CVE-2026-65633: Purpose-limited JWT accepted as full bearer authentication in AshAuthentication. Affects ash_authentication across 4 version ranges.
>= 3.10.5, < 4.14.2
>= 5.0.0-rc.0, < 5.0.0-rc.13
< 124eddd1bbeb40289c3fe8831ac10677a19fcf09
>= eca8cadea0f1595ed2c10a0c177b1da9aa9e5269, < 8cf8b2d4426172be0900a3505e9491800b951750
Fixed in 4.14.2 or 5.0.0-rc.13, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshAuthentication is a library designed for authentication in Elixir applications, providing mechanisms for handling JSON Web Tokens (JWTs) and user sessions. It supports various authentication strategies, including WebAuthn and password-based sign-ins. However, a critical vulnerability exists that allows purpose-limited JWTs to be misused as full bearer tokens, potentially compromising user accounts.
Vulnerability Detail
The vulnerability arises from improper authentication checks in the AshAuthentication library. Specifically, the retrieve_from_bearer function does not verify that the purpose claim of a JWT matches the expected value at the bearer boundary. This flaw allows an attacker to present a valid, purpose-limited JWT (such as a sign-in token) as a general-purpose bearer token, bypassing intended security measures. If an attacker obtains a valid sign-in token, they can authenticate as the associated user without proper validation, leading to unauthorized access.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.10.5, < 4.14.24.14.2 -
>= 5.0.0-rc.0, < 5.0.0-rc.135.0.0-rc.13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that the require_token_presence_for_authentication configuration is set to true in your application. This setting enforces checks on the purpose claim of tokens and mitigates the risk of unauthorized access. Example configuration:
config :ash_authentication, require_token_presence_for_authentication: true
Conclusion
The CVE-2026-65633 vulnerability in the AshAuthentication library poses a significant risk by allowing purpose-limited JWTs to be misused as full bearer tokens. It is crucial to update to the patched versions or implement the recommended workarounds to safeguard your application against unauthorized access.
See every vulnerability recorded for ash_authentication →
FAQ
CVE-2026-65633 is a vulnerability in the AshAuthentication library that allows purpose-limited JWTs to be used as full bearer tokens, potentially leading to unauthorized access.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The vulnerable versions are from 3.10.5 before 4.14.2 and from 5.0.0-rc.0 before 5.0.0-rc.13.
If an immediate update is not possible, configure your application to require token presence for authentication by setting require_token_presence_for_authentication to true.
The CVSS score of this vulnerability is 7.6, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
