CVE-2025-25202: Token Replay in Ash Authentication

The core impact of CVE-2025-25202 lies in the ability for an attacker to reuse revoked tokens. In applications utilizing Ash Authentication's magic link functionality, a revoked token can still be used to authenticate a user until its expiration time. This effectively bypasses the intended security measure of token revocation. For applications implementing manual token revocation, the same vulnerability exists – a revoked token remains valid until it expires. This could lead to unauthorized access to user accounts and sensitive data, potentially enabling attackers to impersonate legitimate users and perform actions on their behalf. The blast radius is limited to applications directly using Ash Authentication and its token management features.

1. Reserved2025-02-03
2. Published2025-02-11
3. Modified2025-02-12
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-25202 is to upgrade Ash Authentication to version 4.4.9 or later. This version includes a fix that prevents the reuse of revoked tokens. If upgrading is not immediately feasible, consider implementing custom token revocation logic within your application to ensure that revoked tokens are immediately invalidated. While a direct WAF rule is unlikely to be effective, reviewing and tightening access control policies can help limit the potential damage from a successful token replay attack. After upgrading, confirm the fix by attempting to reuse a previously revoked token – it should be rejected.