What’s Vulnerable › Products
team-alembic ash_authentication vulnerabilities
21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 21 published in the last 12 months.
Check whether your team-alembic ash_authentication version is affected
Latest team-alembic ash_authentication vulnerabilities
- CVE-2026-86688 — Session id is not renewed on authentication in ash_authentication, allowing session fixation (CVSS 7.4)
- CVE-2026-76949 — Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement (CVSS 9.1)
- CVE-2026-91039 — dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover (CVSS 9.1)
- CVE-2026-88952 — OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication (CVSS 9.1)
- CVE-2026-86533 — Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix (CVSS 9.1)
- CVE-2026-86522 — Log injection via an unescaped password reset identity in AshAuthentication (CVSS 6.3)
- CVE-2026-85500 — `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication (CVSS 9.1)
- CVE-2026-82761 — Magic link single-use tokens replayable via TOCTOU race in AshAuthentication (CVSS 9.1)
- CVE-2026-82760 — Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in (CVSS 8.2)
- CVE-2026-82759 — Reversible IP address pseudonymisation in AshAuthentication audit log hash mode (CVSS 1.8)
- CVE-2026-82723 — Actor record with password digest stored in AshAuthentication audit log entries (CVSS 1.8)
- CVE-2026-82685 — Confirmation token accepted on any record in AshAuthentication (CVSS 7.6)
- CVE-2026-81637 — Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication (CVSS 2.3)
- CVE-2026-81632 — Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix (CVSS 7.2)
- CVE-2026-80218 — Sign-in token minted for one resource accepted by another in AshAuthentication (CVSS 7.6)
- CVE-2026-78223 — Token revocation record built from unverified JWT claims in AshAuthentication (CVSS 6.9)
- CVE-2026-66882 — Reflected XSS in AshAuthentication confirmation and magic link interaction forms (CVSS 2.1)
- CVE-2026-65633 — Purpose-limited JWT accepted as full bearer authentication in AshAuthentication (CVSS 7.6)
- CVE-2026-49757 — OAuth2/OIDC account takeover in AshAuthentication via email-based user matching (CVSS 9.2)
- CVE-2025-32782 — Ash Authentication email link auto-click account confirmation vulnerability (CVSS 5.3)
- CVE-2025-25202 — Ash Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install` (CVSS 6.5)