CVE-2025-4754
Description
Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it. This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.
How to fix
- team-alembic ash_authentication_phoenix2.10.0, a3253fb4fc7145aeb403537af1c24d3a8d51ffb1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| team-alembic ash_authentication_phoenix | 0.1.0 ≤ v < 2.10.0, 05ab4f438bf0cd0fdfb279d912bbe0d2c3620e02 ≤ v < a3253fb4fc7145aeb403537af1c24d3a8d51ffb1 | 2.10.0, a3253fb4fc7145aeb403537af1c24d3a8d51ffb1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.