CWE-1466 vulnerabilities

CVE-2026-110826 is a vulnerability in team-alembic's ash_authentication component where session tokens are not properly invalidated after a user changes or resets their password. This allows an attacker holding a victim's session token to remain signed in despite the password change. The flaw arises because the condition to revoke tokens is evaluated before the new password hash is set, causing token revocation to be skipped in non-atomic password change actions. The issue affects versions from 4.5.0 up to but not including 4.15.1 and from 5.0.0-rc.0 up to but not including 5.0.0-rc.16. Fixed versions are 4.15.1 and 5.0.0-rc.16.