CVE-2026-110826 AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change

Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ashauthentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With applyonpasswordchange? true,...

EEF-CVE-2026-110826 AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change

Summary Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ashauthentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With applyonpasswordchange? true,...

CVE-2026-110826

The ash_authentication library by team-alembic contains an improper session invalidation vulnerability (CWE-1466). When apply_on_password_change? true is enabled, the AshAuthentication.AddOn.LogOutEverywhere.Transformer fails to revoke stored tokens during non-atomic password changes. This occurs...