The vulnerability arises because AshAuthentication.Plug.Helpers.sign_in_using_remember_me/3 checks for a session key "<subject_name>_token" to skip re-authentication of an already signed-in user, but the session key is only written under certain configuration settings. By default, the key checked by the guard is never written, making the guard's check ineffective and causing the remember-me sign-in to run on every request. Consequently, a planted remember-me cookie can override an existing authenticated session, allowing the attacker to hijack the session context. The inconsistency between the guard and the session reader about which session key to use leads to this authentication bypass.

An attacker who can plant a remember-me cookie in a victim's browser can hijack the victim's authenticated session, effectively impersonating the victim. This can lead to unauthorized access to the victim's account and any associated privileges. The vulnerability has a high severity with a CVSS 4.0 score of 9.1, indicating critical impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid scenarios where attackers can plant remember-me cookies in victim browsers. Review configuration settings related to require_token_presence_for_authentication? to understand their effect on session key handling. Monitor vendor channels for patches or updates addressing this issue.