CVE-2025-4754

Missing Session Revocation on Logout in ash_authentication_phoenix

Previous Page: « Back to all CVEs Next Page: See on OSV.dev »

Weakness Type (CWE)

CWE-613 — CWE-613 Insufficient Session Expiration

CAPEC

• CAPEC-593 — CAPEC-593 Session Hijacking

CVSS 4.0 Score

2.3

LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Vulnerability description

Insufficient Session Expiration vulnerability in ash-project ash_authentication_phoenix allows Session Hijacking.

This vulnerability is associated with program files lib/ash_authentication_phoenix/controller.ex.

This issue affects ash_authentication_phoenix until 2.10.0.

Affected

ash-project / ash_authentication_phoenix

Source File
lib/ash_authentication_phoenix/controller.ex

Status	Version	Changes / Fixed in
affected	pkg:hex/ash_authentication_phoenix@0	< pkg:hex/ash_authentication_phoenix@2.10.0
affected	0	< 2.10.0
affected	0	< a3253fb4fc7145aeb403537af1c24d3a8d51ffb1

References

• https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-f7gq-h8jv-h3cq vendor-advisory
• https://github.com/team-alembic/ash_authentication_phoenix/pull/634 patch

Credits

• Remediation reviewer: James Harton
• Remediation developer: Zach Daniel
• Analyst: Mike Buhot
• Analyst: Jonatan Männchen
• Analyst: Josh Price

CVE record as JSON:  GET /cves/cve-2025-4754.json