Race Condition Vulnerability in AshAuthentication by Team Alembic

CVE-2026-82761

What is CVE-2026-82761?

A time-of-check time-of-use (TOCTOU) race condition vulnerability in AshAuthentication allows an attacker to exploit a leaked magic link. This magic link is designed for single-use with a token; however, due to a lack of proper serialization in validating its consumption, attackers can exploit concurrent requests. As a result, multiple authentication attempts can succeed using the same single-use token. When a user attempts to sign in, the JWT verification process and the token revocation mechanism do not synchronize effectively, allowing for a replay of magic tokens before they are revoked. This security flaw primarily impacts versions of ash_authentication from 3.9.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

References