Skip to content
Fencer Vulns
critical 9.1

CVE-2026-82761 json

Magic link single-use tokens replayable via TOCTOU race in AshAuthentication

published 2026-09-17 52 d ago modified 2026-09-18 51 d ago also EEF-CVE-2026-82761 , GHSA-23gr-vcp4-r27q , EUVD-2026-81480

cvss
9.1
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with single_use_token?, which is the default, is meant to be redeemable exactly once, but nothing serialises the token's validity check against its consumption, so concurrent redemptions of one token all succeed and each yields a full user token.

Sign-in verifies the JWT with Jwt.verify/4 and revokes it only afterwards: AshAuthentication.Strategy.MagicLink.SignInPreparation revokes in a Query.after_action callback, and AshAuthentication.Strategy.MagicLink.SignInChange in an after_transaction hook that runs once the sign-in has already committed. AshAuthentication.TokenResource.Actions.revoke/3 writes the revocation as an upsert, so a concurrent duplicate revocation silently succeeds instead of conflicting and no request ever loses the race.

This issue affects ash_authentication: from 3.9.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Patch / fix

  • hex ash_authentication 4.15.0, 5.0.0-rc.14
  • team-alembic ash_authentication 4.15.0, 5.0.0-rc.14

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
52 d ago

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA 4.0 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
hex ash_authentication
>=3.9.0, <4.15.0
>=5.0.0-rc.0, <5.0.0-rc.14
4.15.0
5.0.0-rc.14

Affected products

  • team-alembic ash_authentication

Classification

Weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.