---
id: CVE-2026-78223
title: >-
  Improper Verification of Cryptographic Signature vulnerability in team-alembic
  AshAuthentication allows a caller of the token revocation action to neutralise
  a revocation or write arbitrary rows into the token resource.


  AshAuthenticatio…
summary: >-
  Improper Verification of Cryptographic Signature vulnerability in team-alembic
  AshAuthentication allows a caller of the token revocation action to neutralise
  a revocation or write arbitrary rows into the token resource.


  AshAuthenticatio…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-347
vendor: team-alembic
product: ash_authentication
affected:
  - ash_authentication >= 0.2.0 < 4.15.0
  - ash_authentication >= 5.0.0-rc.0 < 5.0.0-rc.14
  - >-
    team-alembic/ash_authentication >= a939dde9b917c072cdf10c4b0913a9886a4b0231
    < *
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:16:18.527'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78223'
references:
  - url: 'https://cna.erlef.org/cves/CVE-2026-78223.html'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/344cebb12faf68e648d3283394073ba0c0f78459
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/a939dde9b917c072cdf10c4b0913a9886a4b0231
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/commit/eb86353fe5a547c5ff5fd9af0e2c212518c31c9b
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-mfwg-5cpf-px58
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-78223'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
tags:
  - nvd
  - cve.org
epss: 0.00441
epssPercentile: 0.35739
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-17T18:28:12.763636Z'
cvssSource: cna
ingestedAt: '2026-09-17T13:18:16.985Z'
---

## Overview

Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource.

AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the :token argument and decodes it with AshAuthentication.Jwt.peek/1, which delegates to Joken.peek_claims/1 and performs no signature check, unlike Jwt.verify/4. The jti, exp and sub claims it returns are written straight onto the revocation record, guarded only by byte_size(token) > 0. Because expires_at derives from the attacker-chosen exp, a forged copy of a genuine token that keeps the real jti but backdates exp yields a revocation row that is already expired: expunge_expired removes it and the genuine token passes revoked? again. Arbitrary jti and sub values can be inserted the same way.

This issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.