Critical · CVSS 9.1CVE-2026-76949

Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacementCVE-2026-76949

Answer in brief

CVE-2026-76949 records a Critical severity (CVSS 9.1) vulnerability in Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement. The current sources do not mark it as known exploited. The current feed maps team-alembic/ash_authentication (generic), team-alembic/ash_authentication (generic), team-alembic/team-alembic/ash_authentication (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 17, 2026Updated Sep 18, 2026Source checked Nov 2, 2026First seen by HOL Sep 17, 2026Material review Sep 18, 2026

Upstream Advisory

Affected scope and exposure questions

The current feed maps team-alembic/ash_authentication (generic), team-alembic/ash_authentication (generic), team-alembic/team-alembic/ash_authentication (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
team-alembic/ash_authenticationgeneric	>=3d3de314692558d06ec13945f857f00514e95a8c <*	*
team-alembic/ash_authenticationgeneric	>=4.10.0 <4.15.0 \|\| >=5.0.0-rc.0 <5.0.0-rc.14	4.15.0, 5.0.0-rc.14
team-alembic/team-alembic/ash_authenticationgeneric	>=3d3de314692558d06ec13945f857f00514e95a8c <*	*

Recommended response

Check inventory. Check lockfiles and deployed manifests for team-alembic/ash_authentication, team-alembic/ash_authentication, team-alembic/team-alembic/ash_authentication.

Review the reported fix. Source-reported workaround: Set require_token_presence_for_authentication? true on the authenticated resource's token configuration. store_in_session/2 then writes the key the guard reads, so the already-signed-in branch fires and the remember-me sign-in no longer runs against a live session. Note this changes session storage semantics for the whole application and requires a token resource. Otherwise remove the remember-me plug from the browser pipeline, which disables remember-me auto-login entirely.

Sources and claim methodology

Upstream source description

Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account. AshAuthentication.Plug.Helpers.sign_in_using_remember_me/3 skips re-authenticating an already-signed-in visitor by checking the session for "<subject_name>_token", but store_in_session/2 writes that key only when require_token_presence_for_authentication? is enabled and otherwise writes the bare subject name. At the default setting the guard therefore reads a key that is never written, its already-signed-in branch is unreachable, and the remember-me sign-in runs on every request through the per-request browser pipeline plug. A planted remember-me cookie is consequently honoured even for a visitor holding a live authenticated session, so whatever the victim enters afterwards lands in data the attacker controls. The read path in authenticate_resource_from_session/4 selects the key correctly, so the guard and the reader disagree about which key holds the session. This issue affects ash_authentication: from 4.10.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Quoted source text, attributed separately from HOL analysis.

Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacementCVE-2026-76949

Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacementCVE-2026-76949

Key facts

Why this deserves its current priority

Affected scope and exposure questions

Recommended response

Evidence timeline and material changes

Sources and claim methodology