CVE-2026-78223 team-alembic CVE debrief

Who should care

Defenders responsible for AshAuthentication deployments should assess exposure and verify the authenticity of tokens and validating their claims before processing revocation requests.

Why it matters

CVE-2026-78223 is a medium-severity vulnerability in AshAuthentication that allows an attacker to bypass token revocation or write arbitrary data to the token resource. Defenders should prioritize verifying token authenticity and validating claims to prevent potential exploitation.

• Potential for token revocation bypass
• Arbitrary rows can be written to the token resource
• Requires verification of token authenticity and claim validation

Technical summary

The AshAuthentication.TokenResource.RevokeTokenChange.change/3 function reads the :token argument and decodes it with AshAuthentication.Jwt.peek/1, which delegates to Joken.peek_claims/1 and performs no signature check. This allows an attacker to neutralise a revocation or write arbitrary rows into the token resource by manipulating the token's claims, such as jti, exp, and sub. The vulnerability affects ash_authentication versions from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Defenders should prioritize verifying token authenticity and validating claims to prevent potential exploitation.

Defensive priority

Defenders should prioritize verifying the authenticity of tokens and validating their claims before processing revocation requests.

Recommended defensive actions

• Verify the authenticity of tokens and validate their claims before processing revocation requests
• Implement proper signature verification for token revocation
• Restrict access to token revocation functionality
• Monitor for suspicious token revocation activity
• Perform regular security audits to identify potential vulnerabilities
• Maintain up-to-date documentation on token revocation procedures
• Review and update incident response plans to address potential exploitation

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and potential impact require further verification. Affected versions of ash_authentication are from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. The vulnerability allows an attacker to neutralise a revocation or write arbitrary rows into the token resource. Evidence limits suggest verifying token authenticity and claim validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.