{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86688",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T14:24:09.606894Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T14:31:41.961Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "ash_authentication",
          "packageURL": "pkg:hex/ash_authentication",
          "product": "ash_authentication",
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "4.15.0",
              "status": "affected",
              "version": "0.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.0.0-rc.14",
              "status": "affected",
              "version": "5.0.0-rc.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "team-alembic/ash_authentication",
          "packageURL": "pkg:github/team-alembic/ash_authentication",
          "product": "ash_authentication",
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "changes": [
                {
                  "at": "872db454405ecad4fcdabd9ff3d8755d1d6a69ae",
                  "status": "unaffected"
                },
                {
                  "at": "3e1d452cbf1564e87f5f97be882b66fe25af7cfa",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "a939dde9b917c072cdf10c4b0913a9886a4b0231",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eExploitation for account takeover requires a server-side session store (ETS, Mnesia, Redis or a database), where the cookie carries a stable session identifier, and a position from which the attacker can plant that cookie in the victim\u0027s browser: cookie tossing from a sibling subdomain, an HTTP host without HSTS, or a shared or kiosk browser.\u003c/p\u003e\n\u003cp\u003ePhoenix defaults to the signed cookie store, and neither package\u0027s installer changes it. Under that store the authenticated session lives in the re-signed cookie delivered only to the victim, so a planted pre-authentication copy does not become an authenticated session. Attacker-planted session contents, such as a \u003ccode\u003ereturn_to\u003c/code\u003e value, still survive into the authenticated session there.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Exploitation for account takeover requires a server-side session store (ETS, Mnesia, Redis or a database), where the cookie carries a stable session identifier, and a position from which the attacker can plant that cookie in the victim\u0027s browser: cookie tossing from a sibling subdomain, an HTTP host without HSTS, or a shared or kiosk browser.\n\nPhoenix defaults to the signed cookie store, and neither package\u0027s installer changes it. Under that store the authenticated session lives in the re-signed cookie delivered only to the victim, so a planted pre-authentication copy does not become an authenticated session. Attacker-planted session contents, such as a `return_to` value, still survive into the authenticated session there."
            }
          ],
          "value": "Exploitation for account takeover requires a server-side session store (ETS, Mnesia, Redis or a database), where the cookie carries a stable session identifier, and a position from which the attacker can plant that cookie in the victim\u0027s browser: cookie tossing from a sibling subdomain, an HTTP host without HSTS, or a shared or kiosk browser.\n\nPhoenix defaults to the signed cookie store, and neither package\u0027s installer changes it. Under that store the authenticated session lives in the re-signed cookie delivered only to the victim, so a planted pre-authentication copy does not become an authenticated session. Attacker-planted session contents, such as a return_to value, still survive into the authenticated session there."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.15.0",
                  "versionStartIncluding": "0.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.0.0-rc.14",
                  "versionStartIncluding": "5.0.0-rc.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "James Harton"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-09-17T05:24:11.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSession Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim\u0027s browser to hold an authenticated session once that victim signs in.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAuthentication.Plug.Helpers.store_in_session/2\u003c/code\u003e writes the authenticated subject into the existing session with \u003ccode\u003ePlug.Conn.put_session/3\u003c/code\u003e and never calls \u003ccode\u003ePlug.Conn.configure_session(renew: true)\u003c/code\u003e, so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default \u003ccode\u003esuccess/4\u003c/code\u003e injected by \u003ccode\u003eAshAuthentication.Phoenix.Controller.__using__/1\u003c/code\u003e, the \u003ccode\u003eAuthController\u003c/code\u003e emitted by \u003ccode\u003emix ash_authentication_phoenix.install\u003c/code\u003e, and remember-me auto-login. \u003ccode\u003eAshAuthentication.Phoenix.Plug.store_in_session/2\u003c/code\u003e is a \u003ccode\u003edefdelegate\u003c/code\u003e to it. Logout does not close the window either, because \u003ccode\u003eclear_session/2\u003c/code\u003e ends with \u003ccode\u003ePlug.Conn.clear_session/1\u003c/code\u003e, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim\u0027s browser to hold an authenticated session once that victim signs in.\n\n`AshAuthentication.Plug.Helpers.store_in_session/2` writes the authenticated subject into the existing session with `Plug.Conn.put_session/3` and never calls `Plug.Conn.configure_session(renew: true)`, so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default `success/4` injected by `AshAuthentication.Phoenix.Controller.__using__/1`, the `AuthController` emitted by `mix ash_authentication_phoenix.install`, and remember-me auto-login. `AshAuthentication.Phoenix.Plug.store_in_session/2` is a `defdelegate` to it. Logout does not close the window either, because `clear_session/2` ends with `Plug.Conn.clear_session/1`, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle.\n\nThis issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14."
            }
          ],
          "value": "Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim\u0027s browser to hold an authenticated session once that victim signs in.\n\nAshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session with Plug.Conn.put_session/3 and never calls Plug.Conn.configure_session(renew: true), so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default success/4 injected by AshAuthentication.Phoenix.Controller.__using__/1, the AuthController emitted by mix ash_authentication_phoenix.install, and remember-me auto-login. AshAuthentication.Phoenix.Plug.store_in_session/2 is a defdelegate to it. Logout does not close the window either, because clear_session/2 ends with Plug.Conn.clear_session/1, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle.\n\nThis issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-61",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn attacker holding a session identifier they planted before the victim signed in gains that victim\u0027s authenticated session, and with it full account takeover, in deployments using a server-side session store.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An attacker holding a session identifier they planted before the victim signed in gains that victim\u0027s authenticated session, and with it full account takeover, in deployments using a server-side session store."
                }
              ],
              "value": "An attacker holding a session identifier they planted before the victim signed in gains that victim\u0027s authenticated session, and with it full account takeover, in deployments using a server-side session store."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "CWE-384 Session Fixation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T21:58:00.853Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "GitHub Advisory",
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-v577-944g-7h3x"
        },
        {
          "name": "EEF CNA record for CVE-2026-86688",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-86688.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-86688",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-86688"
        },
        {
          "name": "Introducing commit a939dde in team-alembic/ash_authentication",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/a939dde9b917c072cdf10c4b0913a9886a4b0231"
        },
        {
          "name": "Fix commit 872db45 in team-alembic/ash_authentication",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/872db454405ecad4fcdabd9ff3d8755d1d6a69ae"
        },
        {
          "name": "Fix commit 3e1d452 in team-alembic/ash_authentication",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/3e1d452cbf1564e87f5f97be882b66fe25af7cfa"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Session id is not renewed on authentication in ash_authentication, allowing session fixation",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCall \u003ccode\u003ePlug.Conn.configure_session(conn, renew: true)\u003c/code\u003e in your own \u003ccode\u003esuccess/4\u003c/code\u003e before \u003ccode\u003estore_in_session/2\u003c/code\u003e. This is a one-line change in application code and closes the controller sign-in path, though not remember-me auto-login, which does not pass through application code.\u003c/p\u003e\n\u003cp\u003eAdd \u003ccode\u003ePlug.Conn.configure_session(conn, drop: true)\u003c/code\u003e at sign-out so a planted identifier does not survive a logout-then-login cycle.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Call `Plug.Conn.configure_session(conn, renew: true)` in your own `success/4` before `store_in_session/2`. This is a one-line change in application code and closes the controller sign-in path, though not remember-me auto-login, which does not pass through application code.\n\nAdd `Plug.Conn.configure_session(conn, drop: true)` at sign-out so a planted identifier does not survive a logout-then-login cycle."
            }
          ],
          "value": "Call Plug.Conn.configure_session(conn, renew: true) in your own success/4 before store_in_session/2. This is a one-line change in application code and closes the controller sign-in path, though not remember-me auto-login, which does not pass through application code.\n\nAdd Plug.Conn.configure_session(conn, drop: true) at sign-out so a planted identifier does not survive a logout-then-login cycle."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-86688",
    "datePublished": "2026-09-17T21:58:00.853Z",
    "dateReserved": "2026-09-17T00:30:01.485Z",
    "dateUpdated": "2026-09-18T14:31:41.961Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-86688\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-18T14:24:09.606894Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-18T14:29:32.046Z\"}}], \"cna\": {\"title\": \"Session id is not renewed on authentication in ash_authentication, allowing session fixation\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"James Harton\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-61\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"An attacker holding a session identifier they planted before the victim signed in gains that victim\u0027s authenticated session, and with it full account takeover, in deployments using a server-side session store.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAn attacker holding a session identifier they planted before the victim signed in gains that victim\u0027s authenticated session, and with it full account takeover, in deployments using a server-side session store.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"An attacker holding a session identifier they planted before the victim signed in gains that victim\u0027s authenticated session, and with it full account takeover, in deployments using a server-side session store.\", \"base64\": false}]}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7.4, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/team-alembic/ash_authentication\", \"vendor\": \"team-alembic\", \"product\": \"ash_authentication\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.2.0\", \"lessThan\": \"4.15.0\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.0.0-rc.0\", \"lessThan\": \"5.0.0-rc.14\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/ash_authentication\", \"packageName\": \"ash_authentication\", \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/team-alembic/ash_authentication\", \"vendor\": \"team-alembic\", \"product\": \"ash_authentication\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"872db454405ecad4fcdabd9ff3d8755d1d6a69ae\", \"status\": \"unaffected\"}, {\"at\": \"3e1d452cbf1564e87f5f97be882b66fe25af7cfa\", \"status\": \"unaffected\"}], \"version\": \"a939dde9b917c072cdf10c4b0913a9886a4b0231\", \"lessThan\": \"*\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/team-alembic/ash_authentication\", \"packageName\": \"team-alembic/ash_authentication\", \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-v577-944g-7h3x\", \"name\": \"GitHub Advisory\", \"tags\": [\"related\", \"vendor-advisory\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-86688.html\", \"name\": \"EEF CNA record for CVE-2026-86688\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-86688\", \"name\": \"OSV record EEF-CVE-2026-86688\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/team-alembic/ash_authentication/commit/a939dde9b917c072cdf10c4b0913a9886a4b0231\", \"name\": \"Introducing commit a939dde in team-alembic/ash_authentication\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/team-alembic/ash_authentication/commit/872db454405ecad4fcdabd9ff3d8755d1d6a69ae\", \"name\": \"Fix commit 872db45 in team-alembic/ash_authentication\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/team-alembic/ash_authentication/commit/3e1d452cbf1564e87f5f97be882b66fe25af7cfa\", \"name\": \"Fix commit 3e1d452 in team-alembic/ash_authentication\", \"tags\": [\"patch\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Call Plug.Conn.configure_session(conn, renew: true) in your own success/4 before store_in_session/2. This is a one-line change in application code and closes the controller sign-in path, though not remember-me auto-login, which does not pass through application code.\\n\\nAdd Plug.Conn.configure_session(conn, drop: true) at sign-out so a planted identifier does not survive a logout-then-login cycle.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eCall \u003ccode\u003ePlug.Conn.configure_session(conn, renew: true)\u003c/code\u003e in your own \u003ccode\u003esuccess/4\u003c/code\u003e before \u003ccode\u003estore_in_session/2\u003c/code\u003e. This is a one-line change in application code and closes the controller sign-in path, though not remember-me auto-login, which does not pass through application code.\u003c/p\u003e\\n\u003cp\u003eAdd \u003ccode\u003ePlug.Conn.configure_session(conn, drop: true)\u003c/code\u003e at sign-out so a planted identifier does not survive a logout-then-login cycle.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Call `Plug.Conn.configure_session(conn, renew: true)` in your own `success/4` before `store_in_session/2`. This is a one-line change in application code and closes the controller sign-in path, though not remember-me auto-login, which does not pass through application code.\\n\\nAdd `Plug.Conn.configure_session(conn, drop: true)` at sign-out so a planted identifier does not survive a logout-then-login cycle.\", \"base64\": false}]}], \"dateAssigned\": \"2026-09-17T05:24:11.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim\u0027s browser to hold an authenticated session once that victim signs in.\\n\\nAshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session with Plug.Conn.put_session/3 and never calls Plug.Conn.configure_session(renew: true), so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default success/4 injected by AshAuthentication.Phoenix.Controller.__using__/1, the AuthController emitted by mix ash_authentication_phoenix.install, and remember-me auto-login. AshAuthentication.Phoenix.Plug.store_in_session/2 is a defdelegate to it. Logout does not close the window either, because clear_session/2 ends with Plug.Conn.clear_session/1, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle.\\n\\nThis issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eSession Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim\u0027s browser to hold an authenticated session once that victim signs in.\u003c/p\u003e\\n\u003cp\u003e\u003ccode\u003eAshAuthentication.Plug.Helpers.store_in_session/2\u003c/code\u003e writes the authenticated subject into the existing session with \u003ccode\u003ePlug.Conn.put_session/3\u003c/code\u003e and never calls \u003ccode\u003ePlug.Conn.configure_session(renew: true)\u003c/code\u003e, so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default \u003ccode\u003esuccess/4\u003c/code\u003e injected by \u003ccode\u003eAshAuthentication.Phoenix.Controller.__using__/1\u003c/code\u003e, the \u003ccode\u003eAuthController\u003c/code\u003e emitted by \u003ccode\u003emix ash_authentication_phoenix.install\u003c/code\u003e, and remember-me auto-login. \u003ccode\u003eAshAuthentication.Phoenix.Plug.store_in_session/2\u003c/code\u003e is a \u003ccode\u003edefdelegate\u003c/code\u003e to it. Logout does not close the window either, because \u003ccode\u003eclear_session/2\u003c/code\u003e ends with \u003ccode\u003ePlug.Conn.clear_session/1\u003c/code\u003e, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle.\u003c/p\u003e\\n\u003cp\u003eThis issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim\u0027s browser to hold an authenticated session once that victim signs in.\\n\\n`AshAuthentication.Plug.Helpers.store_in_session/2` writes the authenticated subject into the existing session with `Plug.Conn.put_session/3` and never calls `Plug.Conn.configure_session(renew: true)`, so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default `success/4` injected by `AshAuthentication.Phoenix.Controller.__using__/1`, the `AuthController` emitted by `mix ash_authentication_phoenix.install`, and remember-me auto-login. `AshAuthentication.Phoenix.Plug.store_in_session/2` is a `defdelegate` to it. Logout does not close the window either, because `clear_session/2` ends with `Plug.Conn.clear_session/1`, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle.\\n\\nThis issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-384\", \"description\": \"CWE-384 Session Fixation\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Exploitation for account takeover requires a server-side session store (ETS, Mnesia, Redis or a database), where the cookie carries a stable session identifier, and a position from which the attacker can plant that cookie in the victim\u0027s browser: cookie tossing from a sibling subdomain, an HTTP host without HSTS, or a shared or kiosk browser.\\n\\nPhoenix defaults to the signed cookie store, and neither package\u0027s installer changes it. Under that store the authenticated session lives in the re-signed cookie delivered only to the victim, so a planted pre-authentication copy does not become an authenticated session. Attacker-planted session contents, such as a return_to value, still survive into the authenticated session there.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eExploitation for account takeover requires a server-side session store (ETS, Mnesia, Redis or a database), where the cookie carries a stable session identifier, and a position from which the attacker can plant that cookie in the victim\u0027s browser: cookie tossing from a sibling subdomain, an HTTP host without HSTS, or a shared or kiosk browser.\u003c/p\u003e\\n\u003cp\u003ePhoenix defaults to the signed cookie store, and neither package\u0027s installer changes it. Under that store the authenticated session lives in the re-signed cookie delivered only to the victim, so a planted pre-authentication copy does not become an authenticated session. Attacker-planted session contents, such as a \u003ccode\u003ereturn_to\u003c/code\u003e value, still survive into the authenticated session there.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Exploitation for account takeover requires a server-side session store (ETS, Mnesia, Redis or a database), where the cookie carries a stable session identifier, and a position from which the attacker can plant that cookie in the victim\u0027s browser: cookie tossing from a sibling subdomain, an HTTP host without HSTS, or a shared or kiosk browser.\\n\\nPhoenix defaults to the signed cookie store, and neither package\u0027s installer changes it. Under that store the authenticated session lives in the re-signed cookie delivered only to the victim, so a planted pre-authentication copy does not become an authenticated session. Attacker-planted session contents, such as a `return_to` value, still survive into the authenticated session there.\", \"base64\": false}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.15.0\", \"versionStartIncluding\": \"0.2.0\"}, {\"criteria\": \"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.0.0-rc.14\", \"versionStartIncluding\": \"5.0.0-rc.0\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-09-17T21:58:00.853Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-86688\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-18T14:31:41.961Z\", \"dateReserved\": \"2026-09-17T00:30:01.485Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-09-17T21:58:00.853Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}