CVE-2026-86688: Session Fixation Vulnerability in ash_authentication Package
Summary
CVE-2026-86688: Session id is not renewed on authentication in ash_authentication, allowing session fixation. Affects ash_authentication across 4 version ranges.
>= 0.2.0, < 4.15.0
< 3e1d452cbf1564e87f5f97be882b66fe25af7cfa
>= 5.0.0-rc.0, < 5.0.0-rc.14
>= a939dde9b917c072cdf10c4b0913a9886a4b0231, < 872db454405ecad4fcdabd9ff3d8755d1d6a69ae
Fixed in 4.15.0 or 5.0.0-rc.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ash_authentication package is a library designed for authentication in Elixir applications, particularly those using the Phoenix framework. It provides functionalities for user authentication, session management, and integration with various authentication strategies. However, a critical vulnerability has been identified that allows session fixation, potentially compromising user accounts.
Vulnerability Detail
The vulnerability arises from the failure to renew session identifiers upon user authentication within the ash_authentication package. Specifically, the function AshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session without renewing the session identifier. This allows an attacker to plant a session identifier in a victim's browser, enabling them to hijack the authenticated session once the victim logs in. The issue is exacerbated by the fact that the logout process does not clear the session identifier, allowing it to persist across login cycles. This vulnerability affects versions from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
How To Fix
Latest published version: 5.0.0-rc.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.2.0, < 4.15.04.15.0 -
>= 5.0.0-rc.0, < 5.0.0-rc.145.0.0-rc.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can manually renew the session identifier by adding the following line in your success/4 function before calling store_in_session/2:
Plug.Conn.configure_session(conn, renew: true)
Additionally, ensure to drop the session on sign-out by adding:
Plug.Conn.configure_session(conn, drop: true)
Conclusion
The session fixation vulnerability in the ash_authentication package poses a significant risk to user accounts. It is crucial for developers using this package to update to the latest patched versions and implement the recommended workarounds to mitigate potential exploitation.
See every vulnerability recorded for ash_authentication →
FAQ
Session fixation is a type of attack where an attacker sets a user's session identifier to a known value, allowing them to hijack the session once the user logs in.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
If exploited, this vulnerability can lead to full account takeover, allowing attackers to access sensitive user information and perform actions on behalf of the victim.
Yes, the vulnerability has been patched in versions 4.15.0 and 5.0.0-rc.14 of the ash_authentication package.
The CVSS score for this vulnerability is 7.4, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_authentication.
