CVE-2026-78223: Token Revocation Vulnerability in AshAuthentication
Summary
CVE-2026-78223: Token revocation record built from unverified JWT claims in AshAuthentication. Affects ash_authentication across 4 version ranges.
>= 0.2.0, < 4.15.0
>= 5.0.0-rc.0, < 5.0.0-rc.14
>= a939dde9b917c072cdf10c4b0913a9886a4b0231, < 344cebb12faf68e648d3283394073ba0c0f78459
< eb86353fe5a547c5ff5fd9af0e2c212518c31c9b
Fixed in 4.15.0 or 5.0.0-rc.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshAuthentication is an open-source authentication library designed for Elixir applications, providing a framework for managing user authentication and authorization. It allows developers to implement secure token-based authentication mechanisms. However, certain versions of AshAuthentication are vulnerable to a critical issue that can compromise the integrity of token revocation processes.
Vulnerability Detail
The vulnerability arises from improper verification of cryptographic signatures in the AshAuthentication library. Specifically, the RevokeTokenChange.change/3 function reads the :token argument and decodes it without verifying the signature. This allows an attacker to forge a token, manipulate claims such as exp (expiration time), and create a revocation record that is already expired. As a result, genuine tokens can bypass revocation checks, leading to unauthorized access and potential data breaches. The affected versions are from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.2.0, < 4.15.04.15.0 -
>= 5.0.0-rc.0, < 5.0.0-rc.145.0.0-rc.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that you do not rely on the revocation functionality until you can update to a secure version. Additionally, consider implementing additional checks on the token claims manually to mitigate the risk until the library is updated.
Conclusion
CVE-2026-78223 is a significant vulnerability in the AshAuthentication library that can lead to unauthorized access through forged tokens. It is crucial to update to the latest patched versions to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for ash_authentication →
FAQ
CVE-2026-78223 is a vulnerability in the AshAuthentication library that allows attackers to forge tokens and bypass revocation checks.
The vulnerability affects AshAuthentication versions from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.9, indicating a moderate severity level.
If you cannot update the package, implement additional manual checks on token claims and avoid using the revocation functionality until the update is applied.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
