Skip to contentTeam-alembic Ash Authentication vulnerabilities
- team-alembic ash authenticationAshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password changeCVE-2026-110826Fix available6.3 Medium
- team-alembic ash authenticationAshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resourceCVE-2026-118505Fix available6.3 Medium
- team-alembic ash authenticationAshAuthentication TOTP setup lets a user install their own authenticator secret on another user's accountCVE-2026-119215Fix available7.6 High
- team-alembic ash authenticationSession id is not renewed on authentication in ash_authentication, allowing session fixationCVE-2026-86688Fix available7.4 High
- team-alembic ash authenticationRemember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacementCVE-2026-76949Fix available9.1 Critical
- team-alembic ash authenticationdynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeoverCVE-2026-91039Fix available9.1 Critical
- team-alembic ash authenticationOAuth2 sign-in attached to an existing account without an email comparison in AshAuthenticationCVE-2026-88952Fix available9.1 Critical
- team-alembic ash authentication`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthenticationCVE-2026-85500Fix available9.1 Critical
- ash-project ash authentication phoenix, team-alembic ash authentication +1 moreRevoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication PhoenixCVE-2026-86533Fix available9.1 Critical
- ash-project ash authentication phoenix, team-alembic ash authentication +1 moreSingle-use sign-in token placed in a redirect query string in AshAuthenticationPhoenixCVE-2026-81632Fix available7.2 High
- team-alembic ash authenticationSign-in token minted for one resource accepted by another in AshAuthenticationCVE-2026-80218Fix available7.6 High
- team-alembic ash authenticationToken revocation record built from unverified JWT claims in AshAuthenticationCVE-2026-78223Fix available6.9 Medium
- team-alembic ash authenticationLog injection via an unescaped password reset identity in AshAuthenticationCVE-2026-86522Fix available6.3 Medium
- team-alembic ash authenticationReplayable OAuth2 CSRF state retained after a failed callback in AshAuthenticationCVE-2026-81637Fix available2.3 Low
- team-alembic ash authenticationMagic link single-use tokens replayable via TOCTOU race in AshAuthenticationCVE-2026-82761Fix available9.1 Critical
- team-alembic ash authenticationConfirmation token accepted on any record in AshAuthenticationCVE-2026-82685Fix available7.6 High
- team-alembic ash authenticationSuperlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-inCVE-2026-82760Fix available8.2 High
- team-alembic ash authenticationReversible IP address pseudonymisation in AshAuthentication audit log hash modeCVE-2026-82759Fix available1.8 Low
- team-alembic ash authenticationActor record with password digest stored in AshAuthentication audit log entriesCVE-2026-82723Fix available1.8 Low
- team-alembic ash authenticationPurpose-limited JWT accepted as full bearer authentication in AshAuthenticationCVE-2026-65633Fix available7.6 High
- team-alembic ash authenticationReflected XSS in AshAuthentication confirmation and magic link interaction formsCVE-2026-66882Fix available2.1 Low
- team-alembic ash authenticationOAuth2/OIDC account takeover in AshAuthentication via email-based user matchingCVE-2026-49757Fix available9.2 Critical
- ash-project ash authentication phoenixMissing Session Revocation on Logout in ash_authentication_phoenixCVE-2025-4754Fix available2.3 Low
- team-alembic ash authenticationAsh Authentication email link auto-click account confirmation vulnerabilityCVE-2025-32782Fix available5.3 Medium
- alembic ash authenticationAsh Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install`CVE-2025-25202Fix available6.3 Medium