CVE-2025-4754 Missing Session Revocation on Logout in ash_authentication_phoenix
Attackers can reuse stolen session tokens after logout because the library fails to revoke them, allowing unauthorized access until token expiry.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-4754?
CVE-2025-4754 is a low-severity missing authorization vulnerability in team-alembic ash_authentication_phoenix, published on 17 Jun 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards.
The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it.
This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.
Weakness: CWE-613
Which versions are affected by CVE-2025-4754?
3 open source packages ship an affected version, including ash_authentication_phoenix.
| Package | Affected | Fixed in |
|---|---|---|
ash_authentication_phoenix Hex | All versions | 2.10.0 |
ash_authentication_phoenix Hex | All versions | 2.10.0 |
ash_authentication_phoenix Hex | From 0.1.0 | 2.10.0 |
How do I fix CVE-2025-4754?
Upgrade ash_authentication_phoenix to 2.10.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-4754 being exploited?
There is no known exploitation of CVE-2025-4754 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2025-4754, GHSA-f7gq-h8jv-h3cq.