This vulnerability (CVE-2025-4754) in ash_authentication_phoenix arises from insufficient session expiration controls, which can lead to session hijacking attacks. The issue is specifically in the session management implementation within lib/ash_authentication_phoenix/controller.ex. It affects versions prior to 2.10.0, including version 1.0.0. The CVSS 4.0 vector indicates network attack vector, low complexity, partial attack complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity, with no availability impact.

An attacker may exploit the insufficient session expiration to hijack user sessions, potentially gaining unauthorized access to user accounts or actions within the affected application. However, the overall impact is rated low based on the CVSS score of 2.3, reflecting limited severity and exploitability.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing additional session management controls or monitoring for unusual session activity as a precaution.