CVE-2026-76949: ash_authentication Package Vulnerability Allows Session Replacement via Remember-Me Cookies
Summary
CVE-2026-76949: Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for t... Affects ash_authentication across 4 version ranges.
>= 3d3de314692558d06ec13945f857f00514e95a8c, < b9568a53b438247238b1c5a4f49c8d84650f4bba
>= 4.10.0, < 4.15.0
>= 5.0.0-rc.0, < 5.0.0-rc.14
< 9a34136b844abe179da1075067cf2835c64dcc12
Fixed in 4.15.0 or 5.0.0-rc.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ash_authentication package is a library designed for handling authentication in Elixir applications. It provides various strategies for user authentication, including support for remember-me functionality, which allows users to stay signed in across sessions. However, a flaw in its implementation can lead to serious security risks, particularly when the remember-me feature is misconfigured.
Vulnerability Detail
The vulnerability arises from an Authentication Bypass by Spoofing in the ash_authentication package. Specifically, the function responsible for handling remember-me sign-ins does not properly validate session tokens under certain configurations. When a user is already authenticated, the system checks for a session key that is not written unless a specific configuration is enabled. As a result, an attacker can plant a remember-me cookie in a victim's browser, allowing them to silently replace the victim's authenticated session with their own. This means any data the victim enters afterward is sent to the attacker's account without their knowledge, posing a significant risk to user privacy and data integrity.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.10.0, < 4.15.04.15.0 -
>= 5.0.0-rc.0, < 5.0.0-rc.145.0.0-rc.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can set the configuration require_token_presence_for_authentication? to true in your application's token configuration. This change ensures that the session key read by the guard matches the key written in the session, preventing the remember-me sign-in from running against a live session. Alternatively, you can remove the remember-me plug from the browser pipeline to disable the feature entirely.
Conclusion
The CVE-2026-76949 vulnerability in the ash_authentication package poses a significant risk by allowing session replacement through remember-me cookies. It is crucial to update to the latest patched versions or implement the suggested workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for ash_authentication →
FAQ
CVE-2026-76949 is a vulnerability in the ash_authentication package that allows attackers to replace a user's authenticated session using a planted remember-me cookie.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring any signup.
If exploited, this vulnerability allows an attacker to hijack a user's session, leading to unauthorized access to sensitive data and actions performed under the victim's account.
Update your mix.exs file to specify the patched version (4.15.0 or 5.0.0-rc.14 or later) and run mix deps.update ash_authentication to apply the changes.
As a temporary measure, you can enable the configuration require_token_presence_for_authentication? to true or remove the remember-me plug from your browser pipeline.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
