Insufficient Session Expiration Vulnerability in Ash Project Authentication Tool by Alembic
CVE-2025-4754

2.3LOW

Key Information:

Vendor

Ash-project

Status
Ash Authentication Phoenix
Vendor
CVE Published:
17 June 2025

What is CVE-2025-4754?

The Ash Project's ash_authentication_phoenix tool contains a vulnerability that allows session hijacking due to insufficient session expiration mechanisms. This flaw can potentially allow unauthorized users to maintain active sessions, compromising user data and application security. The impacted versions include all prior to 2.10.0, highlighting the need for immediate updates to secure sessions effectively.

Affected Version(s)

ash_authentication_phoenix 1.0.0 < 2.10.0

ash_authentication_phoenix de3ecd611fb0f3b3f9f861f9397c2a5e97f5f4d2

References

https://github.com/team-alembic/ash_authentication_phoeni...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2025-4754.html
related
https://osv.dev/vulnerability/EEF-CVE-2025-4754
related

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

James Harton
Zach Daniel
Mike Buhot
Jonatan Männchen
Josh Price
.