CVE-2026-82761: AshAuthentication Magic Link Token Replay Vulnerability
Summary
CVE-2026-82761: Magic link single-use tokens replayable via TOCTOU race in AshAuthentication. Affects ash_authentication across 4 version ranges.
>= 3.9.0, < 4.15.0
>= 5.0.0-rc.0, < 5.0.0-rc.14
< 9ef6864b8833d3b795427a7b8dc518a4997d41ab
>= cf3d227ef25912cf1b0c5fa80f20001f5c46a102, < 18dfdb36c14aa6a61df8572bce2d5ec36b1d9840
Fixed in 4.15.0 or 5.0.0-rc.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshAuthentication is an authentication library designed for Elixir applications, providing various strategies for user authentication, including magic links. This library allows users to authenticate without traditional passwords, enhancing user experience and security. However, a critical vulnerability has been identified that affects its single-use token mechanism, potentially allowing unauthorized access.
Vulnerability Detail
The vulnerability arises from a Time-of-check Time-of-use (TOCTOU) race condition in AshAuthentication. When a magic link is generated with the single_use_token? option, it is intended to be used only once. However, due to the lack of serialization between the token's validity check and its consumption, multiple concurrent requests can successfully redeem the same token. This flaw allows an attacker with a leaked magic link to authenticate as the intended user, undermining the security of the authentication process. The issue affects versions of AshAuthentication from 3.9.0 to 4.15.0 and from 5.0.0-rc.0 to 5.0.0-rc.14.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.9.0, < 4.15.04.15.0 -
>= 5.0.0-rc.0, < 5.0.0-rc.145.0.0-rc.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing additional checks to ensure that a magic link can only be redeemed once. This could involve tracking the state of each token in a database and ensuring that once a token is used, it is marked as invalid immediately before any further processing occurs.
Conclusion
The CVE-2026-82761 vulnerability in AshAuthentication poses a significant risk to applications using the library. It is crucial to update to the patched versions to mitigate the risk of unauthorized access through replayed magic link tokens. Implementing the suggested workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for ash_authentication →
FAQ
CVE-2026-82761 is a vulnerability in the AshAuthentication library that allows replay of single-use magic link tokens due to a race condition.
If your application uses AshAuthentication and is running an affected version, an attacker could exploit this vulnerability to gain unauthorized access by reusing magic links.
The vulnerability affects AshAuthentication versions from 3.9.0 to 4.15.0 and from 5.0.0-rc.0 to 5.0.0-rc.14.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 9.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
