The vulnerability in ash_authentication involves a TOCTOU race condition where the single-use magic link token can be redeemed multiple times concurrently. The sign-in process verifies the JWT token before revoking it, but the revocation occurs asynchronously after the sign-in has committed, allowing multiple concurrent requests to validate the same token successfully. The revocation is implemented as an upsert operation that does not conflict on concurrent attempts, so no request loses the race. This flaw enables attackers holding a leaked magic link token to authenticate repeatedly as the victim, violating the intended single-use token policy. The affected versions are >=3.9.0 <4.15.0 and >=5.0.0-rc.0 <5.0.0-rc.14.

An attacker with access to a leaked single-use magic link token can replay the token multiple times concurrently to authenticate as the target user multiple times. This breaks the single-use token security model, potentially allowing unauthorized access to user accounts without needing additional credentials or privileges. The vulnerability has a high severity with a CVSS 4.0 score of 9.1, indicating critical impact on confidentiality and integrity without requiring user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider mitigating the risk by avoiding use of single-use magic link tokens or implementing external synchronization to serialize token redemption. Monitor vendor communications for updates on an official fix.