---
id: CVE-2026-110826
title: >-
  AshAuthentication log_out_everywhere leaves sessions valid after a password
  reset or non-atomic password change
summary: >-
  Improper Session Invalidation after Authentication Credential Change
  vulnerability in team-alembic ash_authentication allows an attacker holding a
  victim's session token to stay signed in after the victim resets or changes
  their password…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-1466
vendor: team-alembic
product: ash_authentication
affected:
  - ash_authentication >= 4.5.0 < 4.15.1
  - ash_authentication >= 5.0.0-rc.0 < 5.0.0-rc.16
  - >-
    team-alembic/ash_authentication >= 0993f944fbd8d668f941d2ca818da4a1d5917641
    < *
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T19:39:56.983242Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:40:08.522Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110826'
references:
  - url: >-
      https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-j6f8-qcj9-gh4r
    label: >-
      `log_out_everywhere` in AshAuthentication leaves sessions valid after a
      password reset or non-atomic password change
  - url: 'https://cna.erlef.org/cves/CVE-2026-110826.html'
    label: EEF CNA record for CVE-2026-110826
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-110826'
    label: OSV record EEF-CVE-2026-110826
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/0993f944fbd8d668f941d2ca818da4a1d5917641
    label: Introducing commit 0993f94 in team-alembic/ash_authentication
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/954697f168d55112b5050acddcd936b8bc1fba2b
    label: Fix commit 954697f in team-alembic/ash_authentication
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/2baef4eddeb604569d3564273d03eeef438e002c
    label: Fix commit 2baef4e in team-alembic/ash_authentication
tags:
  - cve.org
epss: 0.00482
epssPercentile: 0.41816
ingestedAt: '2026-11-05T20:33:06.400Z'
---

## Overview

Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password.

With apply_on_password_change? true, AshAuthentication.AddOn.LogOutEverywhere.Transformer adds OnPasswordChange to update actions as a global change guarded by where: changing(hashed_password). That condition is evaluated before the action's before_action hooks run, but AshAuthentication.Strategy.Password.HashPasswordChange sets the new hash in a before_action hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's change_password action are both non-atomic.

This issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.

## Affected

- `ash_authentication >= 4.5.0 < 4.15.1`
- `ash_authentication >= 5.0.0-rc.0 < 5.0.0-rc.16`
- `team-alembic/ash_authentication >= 0993f944fbd8d668f941d2ca818da4a1d5917641 < *`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.