CVE-2025-25202: Ash Authentication Bypass Vulnerability

CVE-2025-25202 Overview

CVE-2025-25202 affects Ash Authentication, an authentication framework for Elixir applications. Applications bootstrapped by the igniter installer since AshAuthentication v4.1.0 generate a :revoked? action that incorrectly validates revoked tokens as valid. The flaw impacts applications using the magic link strategy or manually revoking tokens through the installer-generated action. Magic link tokens remain reusable until expiration, which is capped at 10 minutes. The vulnerability is classified under [CWE-269] Improper Privilege Management and stems from an incorrect generic action generated during project bootstrap.

Critical Impact
Revoked magic link tokens continue to authenticate successfully within their 10-minute validity window, enabling token reuse against affected applications.

Affected Products

Alembic ash_authentication versions from 4.1.0 through 4.4.8
Elixir applications bootstrapped by the AshAuthentication igniter installer
Applications using the magic link strategy or custom token revocation logic based on the generated action

Discovery Timeline

2025-02-11 - CVE-2025-25202 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25202

Vulnerability Analysis

Ash Authentication provides token lifecycle management for Elixir applications, including revocation semantics used by the magic link strategy. The igniter installer, introduced in v4.1.0, emits a generic :revoked? action into the consumer's token resource. This generated action performs an incorrect check and does not treat revoked tokens as invalid. As a result, the framework accepts tokens for verification even after a revocation record is written. Because the internal Ash Authentication revocation logic has always been correct, applications that never received the installer-generated action are unaffected.

Root Cause

The root cause is a defective generic action produced by the installer template, not a flaw in the core library. The :revoked? action shadows the correct internal check with a permissive implementation. This violates the intended privilege management contract for tokens, allowing an authentication artifact whose privileges should be revoked to retain them until natural expiration.

Attack Vector

An attacker who obtains a magic link token can replay it after the application attempts to revoke it. The magic link strategy invalidates tokens on use, but revocation does not take effect. Exploitation requires network access to the authentication endpoint and possession of a valid, unexpired magic link token. The 10-minute token lifetime constrains the abuse window.

text

// Patch excerpt from lib/ash_authentication/add_ons/confirmation/transformer.ex
     with :ok <-
            validate_token_generation_enabled(
              dsl_state,
-             "Token generation must be enabled for password resets to work."
+             "Token generation must be enabled for confirmation to work."
            ),
          :ok <- validate_monitor_fields(dsl_state, strategy),
          strategy <- maybe_set_confirm_action_name(strategy),
// Source: https://github.com/team-alembic/ash_authentication/commit/2dee55252df26fe3d990ff1199397cdcf1bfea8a

Detection Methods for CVE-2025-25202

Indicators of Compromise

Repeated successful authentications using the same magic link token value within a 10-minute window
Successful token verification events occurring after a token revocation entry has been written to the token resource
Presence of a generated :revoked? generic action in the application's token resource module

Detection Strategies

Audit the application's token resource for the installer-generated :revoked? action and compare against the corrected implementation in the 4.4.9 upgrader.
Inspect application authentication logs for magic link token IDs (jti claims) that appear on more than one verification event.
Correlate token revocation writes with subsequent verification attempts to identify accepted-after-revocation events.

Monitoring Recommendations

Enable structured logging for AshAuthentication.Jwt.verify/2 outcomes and forward events to a centralized log store.
Track magic link issuance, consumption, and revocation events keyed by token identifier for post-hoc correlation.
Alert on any authenticated request whose token identifier previously appeared in a revocation record.

How to Mitigate CVE-2025-25202

Immediate Actions Required

Upgrade ash_authentication to version 4.4.9 or later, which ships with an upgrader that applies the corrected revocation check automatically.
Run mix igniter.upgrade ash_authentication to apply the packaged patch, or follow the manual steps printed by the compile-time warning.
Review the token resource for the installer-generated :revoked? action and confirm it matches the patched version.

Patch Information

The fix is available in ash_authentication4.4.9. Version 4.4.9 also emits a compile-time warning with remediation instructions when a vulnerable installer-generated action is detected. Details are published in the GitHub Security Advisory GHSA-qrm9-f75w-hg4c and the remediation commit.

Workarounds

Delete the generated :revoked? generic action from the token resource so the framework falls back to the correct internal implementation in Ash Authentication.
Alternatively, apply the changes contained in the upstream patch by hand to the installer-generated action.
Reduce magic link token lifetime below the default 10 minutes to shrink the reuse window until the upgrade is completed.

bash

# Upgrade using the igniter upgrader shipped with 4.4.9
mix deps.update ash_authentication
mix igniter.upgrade ash_authentication
mix compile --warnings-as-errors