The vulnerability arises from the AshAuthentication.Plug.Helpers.store_in_session/2 function, which writes the authenticated subject into the existing session without renewing the session identifier via Plug.Conn.configure_session(renew: true). Consequently, the session ID that the visitor initially had remains active after authentication, enabling session fixation attacks. This affects all authentication flows that use this function, including default success handlers, AuthController, and remember-me auto-login. Additionally, the logout process clears session contents but does not renew or clear the session identifier, allowing a planted session ID to survive logout and subsequent login cycles. The affected versions are >=0.2.0 <4.15.0 and >=5.0.0-rc.0 <5.0.0-rc.14.

An attacker capable of planting a session identifier in a victim's browser can hijack the victim's authenticated session after they log in, potentially gaining unauthorized access to the victim's account. The persistence of the session identifier across logout and login cycles exacerbates the risk by allowing session fixation even after the victim logs out.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing manual session ID renewal upon authentication and ensure session identifiers are cleared or renewed on logout to mitigate session fixation risks.