Improper Session Invalidation in AshAuthentication by Team Alembic
CVE-2026-110826

6.3MEDIUM

Key Information:

Vendor: Team-alembic
Status: Ash Authentication
Vendor: CVE Published:; 3 November 2026

🔔 Create Team-alembic Vulnerability Alert

What is CVE-2026-110826?

The vulnerability in AshAuthentication allows an attacker to remain signed in after the victim changes their password, due to improper session management. Specifically, the session tokens are not revoked when a password is changed non-atomically, leaving users exposed to potential unauthorized access. This issue affects specific versions of the ash_authentication product, where a failure in session invalidation after authentication credential changes can occur, undermining overall security and user safety.

Affected Version(s)

ash_authentication 4.5.0 < 4.15.1

ash_authentication 5.0.0-rc.0 < 5.0.0-rc.16

ash_authentication 0993f944fbd8d668f941d2ca818da4a1d5917641

References

https://github.com/team-alembic/ash_authentication/securi...

vendor-advisoryrelated

https://cna.erlef.org/cves/CVE-2026-110826.html

https://osv.dev/vulnerability/EEF-CVE-2026-110826

CVSS V4

Score:

6.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 3, 2026
Vulnerability Reserved
Nov 3, 2026

Credit

azmaveth

CVE-2026-110826 Data

JSON