-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ash_authentication_phoenix | erlang | <= 2.9.0 | 2.10.0 |
Miggo AIRoot Cause AnalysisThe vulnerability (CVE-2025-4754, GHSA-f7gq-h8jv-h3cq) in ash_authentication_phoenix prior to version 2.10.0 was an insufficient session expiration issue. Specifically, when a user logged out, the session token was not invalidated on the server. This meant that compromised tokens could be reused until their server-side expiration.
The root cause was traced to the default sign_out/2 function provided by AshAuthentication.Phoenix.Controller. This function, when used by applications, would call clear_session() which, in this context, was an alias for Plug.Conn.clear_session/1. This Elixir Plug function only clears session data from the connection (typically client-side cookies) but does not perform any server-side token revocation.
The patch addresses this by:
sign_out/2 implementation from AshAuthentication.Phoenix.Controller. This forces developers to explicitly handle the sign-out logic.AshAuthentication.Phoenix.Controller.clear_session/2 which, unlike the old clear_session/1 (which was Plug.Conn.clear_session/1), explicitly calls helper functions (Helpers.revoke_bearer_tokens/2 and Helpers.revoke_session_tokens/2) to invalidate tokens on the server before clearing the client-side session with Plug.Conn.clear_session/1.clear_session/1 to AshAuthentication.Phoenix.Controller that raises a compile-time error, guiding users to adopt the new clear_session/2 function.Therefore, the primary vulnerable function was the library's default AshAuthentication.Phoenix.Controller.sign_out/2 due to its incomplete logout procedure. During exploitation, a call to this function (or a user-defined sign_out function that similarly only called Plug.Conn.clear_session/1) would appear in runtime profiles, leading to the session remaining active on the server.
A Semantic Attack on Google Gemini - Read the Latest Research