CVE-2026-80218: AshAuthentication Improper Authentication Vulnerability
Summary
CVE-2026-80218: Sign-in token minted for one resource accepted by another in AshAuthentication. Affects ash_authentication across 4 version ranges.
>= 3.10.5, < 4.15.0
>= 5.0.0-rc.0, < 5.0.0-rc.14
< 7baac243ca651eee127a84d672eee3fcff42e598
>= eca8cadea0f1595ed2c10a0c177b1da9aa9e5269, < 2640e1872e1fef4e4606e601bf00102cff784c03
Fixed in 4.15.0 or 5.0.0-rc.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
AshAuthentication is a library designed for handling authentication in Elixir applications. It provides various strategies for user sign-in, including password-based authentication and token-based sign-in. The library is widely used in applications that require secure user authentication mechanisms. However, it is susceptible to a significant vulnerability that allows an attacker to misuse sign-in tokens across different resources.
Vulnerability Detail
The vulnerability stems from improper authentication handling in AshAuthentication, specifically in the way it processes sign-in tokens. The function 'extract_primary_keys_from_subject' incorrectly parses the JWT 'sub' claim, discarding the path segment that identifies the resource for which the token was issued. This flaw allows an attacker with a valid token for one resource to gain unauthorized access to another resource, leading to potential data breaches and unauthorized actions within the application.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.10.5, < 4.15.04.15.0 -
>= 5.0.0-rc.0, < 5.0.0-rc.145.0.0-rc.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that sign-in tokens are validated against the specific resource they were issued for. This can be implemented by modifying the token verification logic to include checks for the resource path, thus preventing cross-resource token acceptance.
Conclusion
CVE-2026-80218 represents a serious security flaw in the AshAuthentication library that can lead to unauthorized access across resources. It is crucial for developers using this library to update to the latest patched versions and consider implementing additional validation checks as a temporary measure.
See every vulnerability recorded for ash_authentication →
FAQ
CVE-2026-80218 is a vulnerability in the AshAuthentication library that allows an attacker to use a sign-in token meant for one resource to authenticate as a user of another resource.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities in real-time.
The vulnerability affects AshAuthentication versions from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
The CVSS score of this vulnerability is 7.6, indicating a high severity level.
If an immediate update is not possible, implement a workaround by ensuring that tokens are validated against the specific resource they were issued for.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
