Team-alembic vulnerabilities

Products

• Ash Authentication 24
• Ash Authentication Phoenix 3

Newest

• team-alembic ash authentication AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change CVE-2026-110826 Fix available 6.3 MediumNovember 3, 2026
• team-alembic ash authentication AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource CVE-2026-118505 Fix available 6.3 MediumNovember 3, 2026
• team-alembic ash authentication AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account CVE-2026-119215 Fix available 7.6 HighNovember 3, 2026
• team-alembic ash authentication Session id is not renewed on authentication in ash_authentication, allowing session fixation CVE-2026-86688 Fix available 7.4 HighSeptember 17, 2026
• team-alembic ash authentication Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement CVE-2026-76949 Fix available 9.1 CriticalSeptember 17, 2026
• team-alembic ash authentication dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover CVE-2026-91039 Fix available 9.1 CriticalSeptember 17, 2026
• team-alembic ash authentication OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication CVE-2026-88952 Fix available 9.1 CriticalSeptember 17, 2026
• team-alembic ash authentication `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication CVE-2026-85500 Fix available 9.1 CriticalSeptember 17, 2026
• ash-project ash authentication phoenix, team-alembic ash authentication +1 more Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix CVE-2026-86533 Fix available 9.1 CriticalSeptember 17, 2026
• ash-project ash authentication phoenix, team-alembic ash authentication +1 more Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix CVE-2026-81632 Fix available 7.2 HighSeptember 17, 2026
• team-alembic ash authentication Sign-in token minted for one resource accepted by another in AshAuthentication CVE-2026-80218 Fix available 7.6 HighSeptember 17, 2026
• team-alembic ash authentication Token revocation record built from unverified JWT claims in AshAuthentication CVE-2026-78223 Fix available 6.9 MediumSeptember 17, 2026
• team-alembic ash authentication Log injection via an unescaped password reset identity in AshAuthentication CVE-2026-86522 Fix available 6.3 MediumSeptember 17, 2026
• team-alembic ash authentication Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication CVE-2026-81637 Fix available 2.3 LowSeptember 17, 2026
• team-alembic ash authentication Magic link single-use tokens replayable via TOCTOU race in AshAuthentication CVE-2026-82761 Fix available 9.1 CriticalSeptember 17, 2026
• team-alembic ash authentication Confirmation token accepted on any record in AshAuthentication CVE-2026-82685 Fix available 7.6 HighSeptember 17, 2026
• team-alembic ash authentication Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in CVE-2026-82760 Fix available 8.2 HighSeptember 17, 2026
• team-alembic ash authentication Reversible IP address pseudonymisation in AshAuthentication audit log hash mode CVE-2026-82759 Fix available 1.8 LowSeptember 17, 2026
• team-alembic ash authentication Actor record with password digest stored in AshAuthentication audit log entries CVE-2026-82723 Fix available 1.8 LowSeptember 17, 2026
• team-alembic ash authentication Purpose-limited JWT accepted as full bearer authentication in AshAuthentication CVE-2026-65633 Fix available 7.6 HighAugust 25, 2026
• team-alembic ash authentication Reflected XSS in AshAuthentication confirmation and magic link interaction forms CVE-2026-66882 Fix available 2.1 LowAugust 25, 2026
• team-alembic ash authentication OAuth2/OIDC account takeover in AshAuthentication via email-based user matching CVE-2026-49757 Fix available 9.2 CriticalJune 15, 2026
• ash-project ash authentication phoenix Missing Session Revocation on Logout in ash_authentication_phoenix CVE-2025-4754 Fix available 2.3 LowJune 17, 2025
• team-alembic ash authentication Ash Authentication email link auto-click account confirmation vulnerability CVE-2025-32782 Fix available 5.3 MediumApril 14, 2025
• alembic ash authentication Ash Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install` CVE-2025-25202 Fix available 6.3 MediumFebruary 11, 2025