PT-2025-25659 · Ash · Ash Authentication Phoenix

James Harton + 4 · Published 2025-06-17 · Updated 2025-07-04 · CVE-2025-4754

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ash-project ash authentication phoenix versions prior to 2.10.0

Description The issue affects the ash authentication phoenix library, where session tokens remain valid on the server after a user logs out. This creates a security gap where compromised tokens can continue to work, even after the user logs out. The sessions stored in the database still expire, limiting the duration during which this could be exploited. Users cannot fully invalidate their sessions when logging out from shared or potentially compromised devices. However, changing one's password does invalidate all other sessions. This may cause compliance issues with security frameworks requiring complete session invalidation.

Recommendations Upgrade to version 2.10.0. After upgrading, update the AuthController implementation to use the new clear session/2 function with the OTP app name. If the setting require token presence for authentication? is not set to true in the tokens section, enable it if possible, or set authentication.session identifier to :jti. Note that setting require token presence for authentication? to true or setting authentication.session identifier to :jti will log out all currently authenticated users if this was not previously configured. As a temporary workaround, manually revoke tokens in the logout/2 handler in the auth controller.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2025-4754

GHSA-F7GQ-H8JV-H3CQ

Affected Products

Ash Authentication Phoenix

References · 14

• https://github.com/team-alembic/ash_authentication_phoenix/commit/a3253fb4fc7145aeb403537af1c24d3a8d51ffb1 · Patch
• https://github.com/team-alembic/ash_authentication_phoenix/pull/634 · Patch
• https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-f7gq-h8jv-h3cq · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2025-4754 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4754 · Security Note
• https://osv.dev/vulnerability/GHSA-f7gq-h8jv-h3cq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-4754 · Vendor Advisory
• https://github.com/team-alembic/ash_authentication_phoenix · Note
• https://hex.pm/packages/ash_authentication_phoenix · Note
• https://twitter.com/TheErlef/status/1935008646452412879 · Twitter Post
• https://cna.erlef.org/cves/CVE-2025-4754.html · Note
• https://t.me/cvetracker/26426 · Telegram Post
• https://twitter.com/CVEnew/status/1934984671454277755 · Twitter Post
• https://t.me/cvenotify/127705 · Telegram Post