Vulnerability · Published Jun 17, 2025 · Assigned by EEF

CVE-2025-4754Missing Session Revocation on Logout in ash_authentication_phoenix

Low 2.3

In plain English

A low-severity security flaw in ash_authentication_phoenix from team-alembic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 4.0)2.3Low

Exploit odds (30 days)0.5%top 57.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it. This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.

Affected products (as reported)

Vendor	Product	Versions
team-alembic	ash_authentication_phoenix	0.1.0 – before 2.10.0
team-alembic	ash_authentication_phoenix	05ab4f438bf0cd0fdfb279d912bbe0d2c3620e02 – before a3253fb4fc7145aeb403537af1c24d3a8d51ffb1

Weakness: CWE-613 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-f7gq-h8jv-h3cq vendor-advisory, related
EEF CNA record for CVE-2025-4754 related
OSV record EEF-CVE-2025-4754 related
https://github.com/team-alembic/ash_authentication_phoenix/pull/634 patch
Introducing commit 05ab4f4 in team-alembic/ash_authentication_phoenix related
Fix commit a3253fb in team-alembic/ash_authentication_phoenix patch