---
id: CVE-2026-76949
title: >-
  Authentication Bypass by Spoofing vulnerability in team-alembic
  ash_authentication allows an attacker who can plant a remember-me cookie in a
  victim's browser to replace that victim's authenticated session with one for
  the attacker's own…
summary: >-
  Authentication Bypass by Spoofing vulnerability in team-alembic
  ash_authentication allows an attacker who can plant a remember-me cookie in a
  victim's browser to replace that victim's authenticated session with one for
  the attacker's own…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-290
vendor: team-alembic
product: ash_authentication
affected:
  - ash_authentication >= 4.10.0 < 4.15.0
  - ash_authentication >= 5.0.0-rc.0 < 5.0.0-rc.14
  - >-
    team-alembic/ash_authentication >= 3d3de314692558d06ec13945f857f00514e95a8c
    < *
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:16:18.527'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76949'
references:
  - url: 'https://cna.erlef.org/cves/CVE-2026-76949.html'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/3d3de314692558d06ec13945f857f00514e95a8c
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/9a34136b844abe179da1075067cf2835c64dcc12
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/b9568a53b438247238b1c5a4f49c8d84650f4bba
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-hh34-374j-pfr5
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-76949'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
tags:
  - nvd
  - cve.org
epss: 0.00772
epssPercentile: 0.53732
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-18T14:24:28.652087Z'
cvssSource: cna
ingestedAt: '2026-09-17T22:30:21.406Z'
---

## Overview

Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account.

AshAuthentication.Plug.Helpers.sign_in_using_remember_me/3 skips re-authenticating an already-signed-in visitor by checking the session for "<subject_name>_token", but store_in_session/2 writes that key only when require_token_presence_for_authentication? is enabled and otherwise writes the bare subject name. At the default setting the guard therefore reads a key that is never written, its already-signed-in branch is unreachable, and the remember-me sign-in runs on every request through the per-request browser pipeline plug. A planted remember-me cookie is consequently honoured even for a visitor holding a live authenticated session, so whatever the victim enters afterwards lands in data the attacker controls. The read path in authenticate_resource_from_session/4 selects the key correctly, so the guard and the reader disagree about which key holds the session.

This issue affects ash_authentication: from 4.10.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.