CVE-2026-81637: AshAuthentication Replayable OAuth2 CSRF State Vulnerability
Summary
CVE-2026-81637: Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication. Affects ash_authentication across 4 version ranges.
>= 0.6.0, < 4.15.0
>= 5.0.0-rc.0, < 5.0.0-rc.14
>= c5f589058e04239263f50a1430eb17ea6d5dd1a2, < bd4352303bc9d72d007f6818775267585a4bcc2f
< d7f939cd02bd618bcaa304631846fa75ffc419d7
Fixed in 4.15.0 or 5.0.0-rc.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshAuthentication is an authentication library for Elixir applications that provides OAuth2 support among other features. It allows developers to integrate various authentication strategies seamlessly. However, a vulnerability has been identified that affects the security of OAuth2 state management, potentially allowing attackers to exploit session handling flaws.
Vulnerability Detail
The vulnerability arises from insufficient session expiration in AshAuthentication, specifically in the OAuth2 callback handling. When an OAuth2 authentication attempt fails, the library retains the original session parameters, including the OAuth2 state value. This allows an attacker who obtains this state value to replay the callback, potentially signing the victim into an attacker-controlled account. The issue is exacerbated by the fact that the session entry is not cleared on failure, leaving it vulnerable until the next request or session expiry.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.6.0, < 4.15.04.15.0 -
>= 5.0.0-rc.0, < 5.0.0-rc.145.0.0-rc.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that you implement additional checks on the OAuth2 state value before processing callbacks. This could involve validating the state against a known good value or implementing a session timeout mechanism to limit the window of opportunity for replay attacks.
Conclusion
In summary, CVE-2026-81637 presents a significant security risk within the AshAuthentication library due to improper session handling during OAuth2 authentication. It is crucial for developers using this library to update to the latest patched versions and consider implementing additional security measures to protect against potential exploitation.
See every vulnerability recorded for ash_authentication →
FAQ
CVE-2026-81637 is a vulnerability in the AshAuthentication library that allows attackers to exploit OAuth2 state management, potentially leading to unauthorized access.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring installation.
If immediate updates are not possible, consider implementing additional validation checks on OAuth2 state values and session management to mitigate risks.
The vulnerability affects AshAuthentication versions from 0.6.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
The CVSS score for this vulnerability is 2.3, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
