CVE-2026-81637

CVE-2026-81637 is an insufficient session expiration flaw in AshAuthentication (team-alembic, Elixir ecosystem). In AshAuthentication.Strategy.OAuth2.Plug.callback/2, the OAuth2 CSRF state (session_params) is deleted via a rebind inside a with chain, but Elixir's else-block scoping causes every f...

CVE-2026-81637 Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...