CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement
Attackers can hijack victim sessions by planting remember-me cookies due to a logic error in session key verification, allowing unauthorized access to victim data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-76949?
CVE-2026-76949 is a critical authentication bypass vulnerability in team-alembic ash_authentication, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account.
AshAuthentication.Plug.Helpers.sign_in_using_remember_me/3 skips re-authenticating an already-signed-in visitor by checking the session for "<subject_name>_token", but store_in_session/2 writes that key only when require_token_presence_for_authentication? is enabled and otherwise writes the bare subject name. At the default setting the guard therefore reads a key that is never written, its already-signed-in branch is unreachable, and the remember-me sign-in runs on every request through the per-request browser pipeline plug. A planted remember-me cookie is consequently honoured even for a visitor holding a live authenticated session, so whatever the victim enters afterwards lands in data the attacker controls. The read path in authenticate_resource_from_session/4 selects the key correctly, so the guard and the reader disagree about which key holds the session.
This issue affects ash_authentication: from 4.10.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Weakness: CWE-290
Which versions are affected by CVE-2026-76949?
1 open source package ship an affected version, including ash_authentication.
| Package | Affected | Fixed in |
|---|---|---|
ash_authentication Hex | From 4.10.0 | 4.15.0, 5.0.0-rc.14 |
How do I fix CVE-2026-76949?
Upgrade ash_authentication to a fixed version for your release line: 4.15.0 or 5.0.0-rc.14.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-76949 being exploited?
There is no known exploitation of CVE-2026-76949 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-76949, GHSA-hh34-374j-pfr5.