Answer in brief
CVE-2025-4754 records a Unknown severity vulnerability in Missing Session Revocation on Logout in ash_authentication_phoenix. The current sources do not mark it as known exploited. The current feed maps team-alembic/ash_authentication_phoenix (generic), team-alembic/ash_authentication_phoenix (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps team-alembic/ash_authentication_phoenix (generic), team-alembic/ash_authentication_phoenix (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| team-alembic/ash_authentication_phoenixgeneric | >=0.1.0 <2.10.0 | 2.10.0 |
| team-alembic/ash_authentication_phoenixgeneric | >=05ab4f438bf0cd0fdfb279d912bbe0d2c3620e02 <a3253fb4fc7145aeb403537af1c24d3a8d51ffb1 | a3253fb4fc7145aeb403537af1c24d3a8d51ffb1 |
Published upstream
Jun 17, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 22, 2026
Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it. This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.
Quoted source text, attributed separately from HOL analysis.