{"id":"CVE-2023-42446","aliases":["EUVD-2023-2404","GHSA-3cjh-p6pw-jhv9"],"status":"published","title":"Pow Mnesia cache doesn't invalidate all expired keys on startup","description":"Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expire when all `Pow.Store.Backend.MnesiaCache` instances have been shut down for a period that is longer than a session's remaining TTL. Version 1.0.34 contains a patch for this issue. As a workaround, expired keys, including all expired sessions, can be manually invalidated.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00547,"percentile":0.46102,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-298","CWE-672"],"published":"2023-09-18T21:29:22Z","modified":"2026-10-28T02:30:56Z","fixes":[{"ecosystem":"Hex","package":"pow","fixed_in":["1.0.34"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Hex","package":"pow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.14"},{"fixed":"1.0.34"}]}]},{"source":"osv","ecosystem":"Hex","package":"pow","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.14"},{"fixed":"1.0.34"}]}],"versions":["1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.20","1.0.21","1.0.22","1.0.23","1.0.24","1.0.25","1.0.26","1.0.27","1.0.28","1.0.29","1.0.30","1.0.31","1.0.32","1.0.33"]}],"products":[{"vendor":"pow-auth","product":"pow"},{"vendor":"powauth","product":"pow"}],"references":[{"url":"https://github.com/pow-auth/pow/security/advisories/GHSA-3cjh-p6pw-jhv9","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/pow-auth/pow/issues/713","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42446","tags":["advisory"]},{"url":"https://github.com/pow-auth/pow/pull/714","tags":["web"]},{"url":"https://github.com/pow-auth/pow/commit/15dc525be03c466daa5d2119ca7acdec7b24ed17","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3cjh-p6pw-jhv9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42446.json","tags":["advisory"]},{"url":"https://github.com/pow-auth/pow","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-42446","title":"Pow Mnesia cache doesn't invalidate all expired keys on startup","description":"Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expire when all `Pow.Store.Backend.MnesiaCache` instances have been shut down for a period that is longer than a session's remaining TTL. Version 1.0.34 contains a patch for this issue. As a workaround, expired keys, including all expired sessions, can be manually invalidated.","status":"published","published":"2023-09-18T21:29:22.133Z","modified":"2024-09-24T18:11:16.178Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-298"],"updated_at":"2026-11-02T14:35:17.812395Z"}],"euvd":[{"id":"EUVD-2023-2404","description":"Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expire when all `Pow.Store.Backend.MnesiaCache` instances have been shut down for a period that is longer than a session's remaining TTL. Version 1.0.34 contains a patch for this issue. As a workaround, expired keys, including all expired sessions, can be manually invalidated.","status":"published","published":"2023-09-18T21:29:22Z","modified":"2024-09-24T18:11:16Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:14.929509Z"}],"ghsa":[{"id":"GHSA-3cjh-p6pw-jhv9","title":"Pow Mnesia cache doesn't invalidate all expired keys on startup","description":"Use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A cache key may become expired when all `Pow.Store.Backend.MnesiaCache` instances have been shut down for a period that is longer than the keys' remaining TTL and the expired key won't be invalidated on startups.\n\n### Workarounds\n\nThe expired keys, including all expired sessions, can be manually invalidated by running:\n\n```elixir\n:mnesia.sync_transaction(fn -\u003e\n  Enum.each(:mnesia.dirty_select(Pow.Store.Backend.MnesiaCache, [{{Pow.Store.Backend.MnesiaCache, :_, :_}, [], [:\"$_\"]}]), fn {_, key,  {_value, expire}} -\u003e\n    ttl = expire - :os.system_time(:millisecond)\n    if ttl \u003c 0, do: :mnesia.delete({Pow.Store.Backend.MnesiaCache, key})\n  end)\nend)\n```\n\n### References\nhttps://github.com/pow-auth/pow/commit/15dc525be03c466daa5d2119ca7acdec7b24ed17\nhttps://github.com/pow-auth/pow/issues/713\nhttps://github.com/pow-auth/pow/pull/714\n","status":"published","published":"2023-09-19T17:00:08Z","modified":"2023-11-04T05:04:49Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-298","CWE-672"],"updated_at":"2026-11-02T14:37:12.407027Z"}],"nvd":[{"id":"CVE-2023-42446","description":"Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expire when all `Pow.Store.Backend.MnesiaCache` instances have been shut down for a period that is longer than a session's remaining TTL. Version 1.0.34 contains a patch for this issue. As a workaround, expired keys, including all expired sessions, can be manually invalidated.","status":"published","published":"2023-09-18T22:15:47.247Z","modified":"2026-06-17T06:23:50.82Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-298","CWE-672"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"CVE-2023-42446","title":"Pow Mnesia cache doesn't invalidate all expired keys on startup","description":"Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expire when all `Pow.Store.Backend.MnesiaCache` instances have been shut down for a period that is longer than a session's remaining TTL. Version 1.0.34 contains a patch for this issue. As a workaround, expired keys, including all expired sessions, can be manually invalidated.","status":"published","published":"2023-09-18T21:29:22.133Z","modified":"2026-10-28T02:30:56.545007332Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-298"],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"GHSA-3cjh-p6pw-jhv9","title":"Pow Mnesia cache doesn't invalidate all expired keys on startup","description":"Use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A cache key may become expired when all `Pow.Store.Backend.MnesiaCache` instances have been shut down for a period that is longer than the keys' remaining TTL and the expired key won't be invalidated on startups.\n\n### Workarounds\n\nThe expired keys, including all expired sessions, can be manually invalidated by running:\n\n```elixir\n:mnesia.sync_transaction(fn -\u003e\n  Enum.each(:mnesia.dirty_select(Pow.Store.Backend.MnesiaCache, [{{Pow.Store.Backend.MnesiaCache, :_, :_}, [], [:\"$_\"]}]), fn {_, key,  {_value, expire}} -\u003e\n    ttl = expire - :os.system_time(:millisecond)\n    if ttl \u003c 0, do: :mnesia.delete({Pow.Store.Backend.MnesiaCache, key})\n  end)\nend)\n```\n\n### References\nhttps://github.com/pow-auth/pow/commit/15dc525be03c466daa5d2119ca7acdec7b24ed17\nhttps://github.com/pow-auth/pow/issues/713\nhttps://github.com/pow-auth/pow/pull/714\n","status":"published","published":"2023-09-19T17:00:08Z","modified":"2025-12-10T00:58:47.685114Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-298","CWE-672"],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}