Ash Authentication hat fehlerhafte Token-Widerrufsprüfungslogik in Aktionen, die von `mix ash_authentication.install` generiert werden

The core of this vulnerability lies in the handling of token revocation within Ash Authentication. Specifically, applications leveraging the built-in magic link functionality are susceptible. An attacker who has previously obtained a magic link token can reuse it even after it has been revoked, effectively bypassing the intended security measure. This allows them to authenticate as the user associated with the token without proper authorization. The potential impact extends beyond simple authentication bypass; an attacker could gain access to sensitive user data, perform actions on behalf of the user, and potentially compromise the entire application, depending on the permissions granted to authenticated users. While custom token revocation implementations are not affected, many applications rely on the default behavior, making them vulnerable.

Elixir applications utilizing Ash Authentication, particularly those employing the magic link authentication strategy or implementing custom token revocation mechanisms, are at risk. Shared hosting environments where multiple applications share the same Ash Authentication instance could also amplify the potential impact.

1. 2025-02-11Disclosure

   disclosure

1. Reserviert2025-02-03
2. Veröffentlicht2025-02-11
3. Geändert2025-02-12
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2025-25202 is to upgrade Ash Authentication to version 4.4.9 or later. This version includes a fix that prevents the reuse of revoked tokens. If an immediate upgrade is not feasible, consider implementing custom token revocation logic within your application to ensure that revoked tokens are properly invalidated. While not a direct fix, temporarily disabling the magic link functionality can reduce the attack surface. Monitor application logs for suspicious authentication attempts, particularly those involving tokens that should have been revoked. After upgrading, confirm the fix by attempting to reuse a previously revoked token – it should be rejected.