CVE-2026-110826

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.5.0 through 4.15.0 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.15

Description An issue exists where session tokens are not properly invalidated after a user changes or resets their password. This occurs when the apply on password change? setting is true and the AshAuthentication.AddOn.LogOutEverywhere.Transformer uses a condition where: changing(hashed password) that is evaluated before before action hooks. Because AshAuthentication.Strategy.Password.HashPasswordChange sets the new hash within a before action hook, non-atomic password changes—including the generated password reset action and the change password action—fail to trigger the revocation of stored tokens. This allows an attacker who already possesses a victim's session token to remain authenticated.

Recommendations Update ash authentication to version 4.15.1 or later. Update ash authentication to version 5.0.0-rc.16 or later.