Answer in brief
CVE-2026-110826 records a Medium severity (CVSS 6.3) vulnerability in AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change. The current sources do not mark it as known exploited. The current feed maps team-alembic/ash_authentication (generic), team-alembic/team-alembic/ash_authentication (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps team-alembic/ash_authentication (generic), team-alembic/team-alembic/ash_authentication (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| team-alembic/ash_authenticationgeneric | >=4.5.0 <4.15.1 || >=5.0.0-rc.0 <5.0.0-rc.16 | 4.15.1, 5.0.0-rc.16 |
| team-alembic/team-alembic/ash_authenticationgeneric | >=0993f944fbd8d668f941d2ca818da4a1d5917641 <* | * |
Published upstream
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 3, 2026
Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With apply_on_password_change? true, AshAuthentication.AddOn.LogOutEverywhere.Transformer adds OnPasswordChange to update actions as a global change guarded by where: changing(hashed_password). That condition is evaluated before the action's before_action hooks run, but AshAuthentication.Strategy.Password.HashPasswordChange sets the new hash in a before_action hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's change_password action are both non-atomic. This issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.
Quoted source text, attributed separately from HOL analysis.