LiveActive security incident?Get immediate response
CVE Record

CVE-2025-4754: Missing Session Revocation on Logout in ash_authentication_phoenix

Insufficient Session Expiration vulnerability in ash-project ash_authentication_phoenix allows Session Hijacking. This vulnerability is associated with program files lib/ash_authentication_phoenix/controller.ex. This issue affects ash_authentication_phoenix until 2.10.0.

LowCVSS 2.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

Logging out may not invalidate an existing session in affected ash_authentication_phoenix deployments. Someone possessing that session could continue accessing the application after the user believes access ended. The supplied CVSS 4.0 score is 2.3, indicating limited confidentiality and integrity impact without availability impact.

Executive priority

Treat as a routine but time-bound authentication fix. Prioritize deployments handling sensitive data or operating on shared devices. Emergency response is not supported by the supplied low severity or exploitation evidence, but delayed remediation leaves users with misleading logout protection.

Technical view

CVE-2025-4754 is a CWE-613 insufficient session expiration flaw associated with lib/ash_authentication_phoenix/controller.ex. Logout does not reliably revoke the existing session, enabling continued reuse and potential session hijacking. The bundle describes versions before 2.10.0 as affected, but its structured version entries are incomplete and should be verified against the vendor advisory.

Likely exposure

Exposure is limited to applications using affected ash_authentication_phoenix versions and relying on logout to revoke sessions. Risk becomes relevant when another party already possesses a valid session. Internet-facing applications, shared devices, and sensitive authenticated functions increase practical business concern.

Exploitation context

The source bundle provides no evidence of active exploitation, and the CVE is not listed as KEV. The CVSS vector indicates network reachability but also required preconditions and user participation. This is primarily a persistence opportunity after session access is obtained, not evidence of initial account compromise.

Researcher notes

The supplied record identifies controller.ex and references pull request 634 plus commit a3253fb4fc7145aeb403537af1c24d3a8d51ffb1. Structured affected-version entries list isolated identifiers with defaultStatus unaffected, conflicting with the narrative range. Confirm exact vulnerable and fixed versions from the vendor advisory before final asset classification.

Mitigation direction

  • Inventory applications and lockfiles for ash_authentication_phoenix and record deployed versions.
  • Upgrade to the vendor-confirmed fixed release after checking the advisory's precise affected range.
  • Apply the referenced vendor patch if an immediate supported upgrade is unavailable.
  • Consider invalidating existing sessions after remediation where operationally appropriate.
  • Review vendor guidance for any additional session-revocation configuration requirements.

Validation and detection

  • Confirm production package versions against the vendor advisory and resolved dependency lockfiles.
  • Test in a controlled environment that a session becomes unusable immediately after logout.
  • Verify direct logout paths and application-specific logout integrations enforce revocation.
  • Review authentication logs for session use continuing after recorded logout events.
  • Retest session behavior after upgrading or applying the vendor patch.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-613: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-4754 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
2.3 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
2.3CVSS 4.0LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N——EEF

Vulnerability scoring details

Base CVSS 4.0 score

2.3Low
CVSS 4.0 vector shape for CVE-2025-4754Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
ash-projectash_authentication_phoenixash_authentication_phoenix, 1.0.0unaffected
ash-projectash_authentication_phoenixteam-alembic/ash_authentication_phoenix, de3ecd611fb0f3b3f9f861f9397c2a5e97f5f4d2unaffected
Weakness

CWE details

CWE-613

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-613 · source CWE mapping

Insufficient Session Expiration

Insufficient Session Expiration represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs