{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0.6.0"
              },
              {
                "fixed": "4.15.0"
              },
              {
                "introduced": "5.0.0-rc.0"
              },
              {
                "fixed": "5.0.0-rc.14"
              }
            ],
            "source": [
              "DESCRIPTION",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "3a54be6b32e53ec9f07f9bc19597f06edad61132"
            },
            {
              "fixed": "d6b2be35cf8f0b8ab84e7a934cfb0d91de0a3c17"
            },
            {
              "introduced": "6767fe27eb952e5bc09aa2e5a7d8f96f5a1c424a"
            },
            {
              "fixed": "fea75958a081ed337ceb578396174039694c48df"
            },
            {
              "fixed": "bd4352303bc9d72d007f6818775267585a4bcc2f"
            },
            {
              "fixed": "c5f589058e04239263f50a1430eb17ea6d5dd1a2"
            },
            {
              "fixed": "d7f939cd02bd618bcaa304631846fa75ffc419d7"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-3vcj-gxx8-3p44"
  ],
  "database_specific": {
    "cna_assigner": "EEF",
    "cwe_ids": [
      "CWE-613"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81637.json",
    "unresolved_ranges": [
      {
        "extracted_events": [
          {
            "introduced": "c5f589058e04239263f50a1430eb17ea6d5dd1a2"
          },
          {
            "fixed": "*"
          }
        ],
        "source": "AFFECTED_FIELD"
      }
    ]
  },
  "details": "Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account.\n\nAshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored session_params through a rebinding step inside its with chain, conn \u003c- delete_session(conn, session_key). Elixir evaluates the else block in the scope enclosing the with, so every failure path (the provider returning ?error=access_denied, an invalid code, a token-exchange error, or a registration or sign-in failure) reaches store_authentication_result/2 holding the original connection and the session entry is never removed. The value the module's own comment describes as protection against a CSRF-related attack is therefore consumed only when authentication succeeds, and survives a cancelled or failed attempt until the next request phase or session expiry.\n\nThis issue affects ash_authentication: from 0.6.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.",
  "id": "CVE-2026-81637",
  "modified": "2026-09-20T11:30:59.106464917Z",
  "published": "2026-09-17T13:09:06.571Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-81637.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-81637"
    },
    {
      "type": "WEB",
      "url": "https://repo.hex.pm"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81637.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-3vcj-gxx8-3p44"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81637"
    },
    {
      "type": "FIX",
      "url": "https://github.com/team-alembic/ash_authentication/commit/bd4352303bc9d72d007f6818775267585a4bcc2f"
    },
    {
      "type": "FIX",
      "url": "https://github.com/team-alembic/ash_authentication/commit/c5f589058e04239263f50a1430eb17ea6d5dd1a2"
    },
    {
      "type": "FIX",
      "url": "https://github.com/team-alembic/ash_authentication/commit/d7f939cd02bd618bcaa304631846fa75ffc419d7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/team-alembic/ash_authentication"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication"
}