{"affected":[{"defaultStatus":"unaffected","ecosystem":"hex","packageName":"ash_authentication","product":"ash_authentication","source":"CNA: EEF","vendor":"team-alembic","versions":[{"lessThan":"4.15.1","status":"affected","version":"4.5.0","versionType":"semver"},{"lessThan":"5.0.0-rc.16","status":"affected","version":"5.0.0-rc.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"github","packageName":"team-alembic/ash_authentication","product":"ash_authentication","source":"CNA: EEF","vendor":"team-alembic","versions":[{"changes":[{"at":"954697f168d55112b5050acddcd936b8bc1fba2b","status":"unaffected"},{"at":"2baef4eddeb604569d3564273d03eeef438e002c","status":"unaffected"}],"lessThan":"*","status":"affected","version":"0993f944fbd8d668f941d2ca818da4a1d5917641","versionType":"git"}]}],"cveId":"CVE-2026-110826","cwes":["CWE-1466"],"description":"Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password.\n\nWith apply_on_password_change? true, AshAuthentication.AddOn.LogOutEverywhere.Transformer adds OnPasswordChange to update actions as a global change guarded by where: changing(hashed_password). That condition is evaluated before the action's before_action hooks run, but AshAuthentication.Strategy.Password.HashPasswordChange sets the new hash in a before_action hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's change_password action are both non-atomic.\n\nThis issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"CNA: EEF","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793734808522,"publishedAt":1793733566188,"references":[{"source":"CNA: EEF","tags":["vendor-advisory","related"],"url":"https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-j6f8-qcj9-gh4r"},{"source":"CNA: EEF","tags":["related"],"url":"https://cna.erlef.org/cves/CVE-2026-110826.html"},{"source":"CNA: EEF","tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-110826"},{"source":"CNA: EEF","tags":["related"],"url":"https://github.com/team-alembic/ash_authentication/commit/0993f944fbd8d668f941d2ca818da4a1d5917641"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/team-alembic/ash_authentication/commit/954697f168d55112b5050acddcd936b8bc1fba2b"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/team-alembic/ash_authentication/commit/2baef4eddeb604569d3564273d03eeef438e002c"}],"remediation":[{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/team-alembic/ash_authentication/commit/954697f168d55112b5050acddcd936b8bc1fba2b"},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/team-alembic/ash_authentication/commit/2baef4eddeb604569d3564273d03eeef438e002c"}],"revision":"b4c5dd46d3f8762780003176a88d3e0db93a49096489d556ad4290c223bd9c7d","sources":[{"modifiedAt":1793734808522,"name":"CNA: EEF","retrievedAt":1793736518405,"url":"https://www.cve.org/CVERecord?id=CVE-2026-110826"}],"ssvc":{"assessedAt":1793734796983,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change","updatedAt":1793736518405}