vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-4754

Missing Session Revocation on Logout in ash_authentication_phoenix

LOW
2.3
CVSS Score
Published: June 17, 2025 at 02:31 PM UTC
Updated: September 22, 2026 at 10:17 AM UTC
1 product affected across 1 vendorAsh Authentication Phoenix

Using ash_authentication_phoenix by ash-project?

Get instant alerts when new vulnerabilities affect ash_authentication_phoenix - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
LOW2.3
Exploit prediction
EPSS 0.5%
SSVC
No known exploit

Description

Insufficient Session Expiration vulnerability in ash-project ash_authentication_phoenix allows Session Hijacking. This vulnerability is associated with program files lib/ash_authentication_phoenix/controller.ex. This issue affects ash_authentication_phoenix until 2.10.0.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ash Authentication Phoenix· Alembichex
80%
0.1.0 ≤ v < 2.10.00.1.05ab4f438bf0cd0fdfb279d912bbe0d2c3620e2
Vendor states this is fixed in a3253fb4fc7145aeb403537af1c24d3a8d51ffb1 (fixed)
Affected range stops below 2.10.0, so it looks safe — our inference, not a vendor statement

References (6)

Patch
Source: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
https://github.com/team-alembic/ash_authentication_phoenix/commit/a3253fb4fc7145aeb403537af1c24d3a8d51ffb1
Patch
Source: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
https://github.com/team-alembic/ash_authentication_phoenix/pull/634
Vendor AdvisoryRelated
Source: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
https://github.com/team-alembic/ash_authentication_phoenix/security/advisories/GHSA-f7gq-h8jv-h3cq
Related
Source: cverecord
https://cna.erlef.org/cves/CVE-2025-4754.html
Related
Source: cverecord
https://osv.dev/vulnerability/EEF-CVE-2025-4754
Related
Source: cverecord
https://github.com/team-alembic/ash_authentication_phoenix/commit/05ab4f438bf0cd0fdfb279d912bbe0d2c3620e02

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

2.3LOWEEF
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-613

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card