ash_authentication lets attackers plant 2FA secrets, skip sign-in limits and keep sessions
A login library flaw for Elixir apps can expose user accounts.
Summary
ash_authentication is a library for adding sign-in to Elixir apps. Several flaws let attackers install their own second-factor secret on another user's account, guess passwords and one-time codes without limit, or stay signed in after a password change.
Affected when
- TOTP setup actions exposed by record key the caller chooses (AshJsonApi, AshGraphql, or a controller passing a looked-up user)
- brute_force_strategy set while protected actions are defined on the resource without the matching preparation
- apply_on_password_change? true with a non-atomic password change
What to do
Update to 5.0.0-rc.16. If you run 4.x, update to 4.15.1. Until then, call setup actions only for the signed-in user and add the missing preparation to protected actions.
Update to at least the version for your product:
- ash_authentication 5.0 5.0.0-rc.16 or later
- ash_authentication 4.x 4.15.1 or later
Products and platforms
CVE IDs
Sources
Times
First published
First seen