{"id":"CVE-2023-42446","aliases":["GHSA-3cjh-p6pw-jhv9"],"url":"https://o3.security/vulnerability/CVE-2023-42446","summary":"Pow Mnesia cache doesn't invalidate all expired keys on startup","details":"Use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A cache key may become expired when all `Pow.Store.Backend.MnesiaCache` instances have been shut down for a period that is longer than the keys' remaining TTL and the expired key won't be invalidated on startups.\n\n### Workarounds\n\nThe expired keys, including all expired sessions, can be manually invalidated by running:\n\n```elixir\n:mnesia.sync_transaction(fn ->\n  Enum.each(:mnesia.dirty_select(Pow.Store.Backend.MnesiaCache, [{{Pow.Store.Backend.MnesiaCache, :_, :_}, [], [:\"$_\"]}]), fn {_, key,  {_value, expire}} ->\n    ttl = expire - :os.system_time(:millisecond)\n    if ttl < 0, do: :mnesia.delete({Pow.Store.Backend.MnesiaCache, key})\n  end)\nend)\n```\n\n### References\nhttps://github.com/pow-auth/pow/commit/15dc525be03c466daa5d2119ca7acdec7b24ed17\nhttps://github.com/pow-auth/pow/issues/713\nhttps://github.com/pow-auth/pow/pull/714\n","published":"2023-09-18T21:29:22.133Z","modified":"2026-08-12T03:51:35.376235373Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Hex","name":"pow","fixedVersion":"1.0.34"}],"fix":{"url":"https://github.com/pow-auth/pow/pull/714","label":"pow-auth/pow#714"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42446.json"},{"type":"ADVISORY","url":"https://github.com/pow-auth/pow/security/advisories/GHSA-3cjh-p6pw-jhv9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42446"},{"type":"REPORT","url":"https://github.com/pow-auth/pow/issues/713"},{"type":"WEB","url":"https://github.com/pow-auth/pow/pull/714"},{"type":"WEB","url":"https://github.com/pow-auth/pow/commit/15dc525be03c466daa5d2119ca7acdec7b24ed17"},{"type":"PACKAGE","url":"https://github.com/pow-auth/pow"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:35.376235373Z"}}