https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 05:31:53 +0000 https://cve.radiocsirt.org/vuln/cve-2025-4754 <p><strong>Affected:</strong> team-alembic ash_authentication_phoenix</p> <p>Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards.</p> <p>The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application&#39;s auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it.</p> <p>This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.</p> <p><strong>Affected:</strong> team-alembic ash_authentication_phoenix</p> <p>Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards.</p> <p>The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application&#39;s auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it.</p> <p>This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0.</p> https://cve.radiocsirt.org/vuln/cve-2025-4754