Vulnerability in Ash Authentication Framework for Elixir Applications
CVE-2025-25202

6.3MEDIUM

Key Information:

Vendor

Team-alembic

Status
Ash Authentication
Vendor
CVE Published:
11 February 2025

What is CVE-2025-25202?

Ash Authentication, an authentication framework for Elixir applications, has a vulnerability that allows magic link tokens to be reused for validation under specific conditions. Applications created using the igniter installer of AshAuthentication from v4.1.0 onwards, which implement the 'magic link' login strategy or manually revoke tokens, may find that these revoked tokens can still authenticate users. Although the valid duration of magic link tokens is only 10 minutes, leaving a narrow window for exploitation, vulnerabilities should be addressed urgently. The issue is resolved in version 4.4.9, which includes an upgrader tool, encouraging users to implement the patch by running mix igniter.upgrade ash_authentication. For those not using the built-in functionality or who have custom token revocation methods, the impact may vary. Users are recommended to follow the remediation guidance provided in the compiler warning upon upgrading.

Affected Version(s)

ash_authentication >= 4.1.0, < 4.4.9

References

https://github.com/team-alembic/ash_authentication/securi...
x_refsource_CONFIRM
https://github.com/team-alembic/ash_authentication/commit...
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.