CVE-2026-110826
AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change
Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With apply_on_password_change? true, AshAuthentication.AddOn.LogOutEverywhere.Transformer adds OnPasswordChange to update actions as a global change guarded by where: changing(hashed_password). That condition is evaluated before the action's before_action hooks run, but AshAuthentication.Strategy.Password.HashPasswordChange sets the new hash in a before_action hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's change_password action are both non-atomic. This issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.
Fixes and workarounds
Fix
The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.
Source: CNA: EEFFix
The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.
Source: CNA: EEFAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| ash_authentication team-alembic ash_authentication
hex |
≥ 4.5.0; < 4.15.1 (affected, semver) ≥ 5.0.0-rc.0; < 5.0.0-rc.16 (affected, semver) Other versions: unaffected |
CNA: EEF |
| ash_authentication team-alembic team-alembic/ash_authentication
github |
≥ 0993f944fbd8d668f941d2ca818da4a1d5917641; < * (affected, git); unaffected at 954697f168d55112b5050acddcd936b8bc1fba2b; unaffected at 2baef4eddeb604569d3564273d03eeef438e002c
Other versions: unaffected |
CNA: EEF |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 6.3 medium |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | CNA: EEF |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-j6f8-qcj9-gh4rCNA: EEF · vendor-advisory, related
- https://cna.erlef.org/cves/CVE-2026-110826.htmlCNA: EEF · related
- https://osv.dev/vulnerability/EEF-CVE-2026-110826CNA: EEF · related
- https://github.com/team-alembic/ash_authentication/commit/0993f944fbd8d668f941d2ca818da4a1d5917641CNA: EEF · related
- https://github.com/team-alembic/ash_authentication/commit/954697f168d55112b5050acddcd936b8bc1fba2bCNA: EEF · patch
- https://github.com/team-alembic/ash_authentication/commit/2baef4eddeb604569d3564273d03eeef438e002cCNA: EEF · patch
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.