CVE-2026-76949

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.10.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13

Description An authentication bypass by spoofing allows an attacker to replace a victim's authenticated session with their own account by planting a remember-me cookie in the victim's browser. This occurs because the function sign in using remember me/3 checks the session for a <subject name> token key to avoid re-authenticating already-signed-in users. However, the store in session/2 function only writes this key when require token presence for authentication? is enabled; otherwise, it writes only the subject name. Under default settings, the guard reads a key that is never written, causing the remember-me sign-in process to run on every request. Consequently, a planted cookie is honored even if a live session exists, leading the victim to unknowingly enter data into an account controlled by the attacker. This discrepancy exists because the read path in authenticate resource from session/4 selects the key correctly, while the guard does not.

Recommendations Update ash authentication to version 4.15.0 or later. Update ash authentication to version 5.0.0-rc.14 or later. Set require token presence for authentication? to true on the authenticated resource's token configuration. Remove the remember-me plug from the browser pipeline to disable remember-me auto-login entirely.