Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

ash_authentication — Vulnerabilities & Security Advisories 20

All 20 CVE vulnerabilities found in ash_authentication, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses and vendor advisories specifically for the ash_authentication authentication product. The collection covers a comprehensive range of vulnerability types, including privilege escalation, authentication bypass, and insecure credential handling, spanning reports published from the product's initial release through the current year. Readers can utilize this resource to track the vendor's historical security advisories, understand the specific characteristics of common authentication weaknesses affecting this software, or review the complete vulnerability history of the product to assess its security posture over time. The data is compiled from public disclosures, vendor bulletins, and technical analysis reports to provide a centralized view of security issues without requiring cross-referencing of multiple external sources. This aggregation supports security teams in conducting thorough risk assessments and prioritizing remediation efforts based on the severity and age of identified flaws. By presenting a consolidated timeline of issues, the page facilitates a clearer understanding of how the product's security has evolved and highlights recurring patterns in its design or implementation that may require architectural changes.

Vendor: team-alembic

CVE ID Title CVSS Severity Published
CVE-2026-86688 Session id is not renewed on authentication in ash_authentication, allowing session fixation CWE-384 7.4 High 2026-09-17
CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement CWE-290 9.1 Critical 2026-09-17
CVE-2026-91039 dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover CWE-290 9.1 Critical 2026-09-17
CVE-2026-88952 OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication CWE-287 9.1 Critical 2026-09-17
CVE-2026-85500 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication CWE-305 9.1 Critical 2026-09-17
CVE-2026-86533 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix CWE-613 9.1 Critical 2026-09-17
CVE-2026-80218 Sign-in token minted for one resource accepted by another in AshAuthentication CWE-287 7.6 High 2026-09-17
CVE-2026-78223 Token revocation record built from unverified JWT claims in AshAuthentication CWE-347 6.9 Medium 2026-09-17
CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication CWE-117 6.3 Medium 2026-09-17
CVE-2026-81637 Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication CWE-613 2.3 Low 2026-09-17
CVE-2026-82761 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication CWE-367 9.1 Critical 2026-09-17
CVE-2026-82685 Confirmation token accepted on any record in AshAuthentication CWE-639 7.6 High 2026-09-17
CVE-2026-82760 Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in CWE-407 8.2 High 2026-09-17
CVE-2026-82759 Reversible IP address pseudonymisation in AshAuthentication audit log hash mode CWE-760 1.8 Low 2026-09-17
CVE-2026-82723 Actor record with password digest stored in AshAuthentication audit log entries CWE-532 1.8 Low 2026-09-17
CVE-2026-65633 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication CWE-287 7.6 High 2026-08-25
CVE-2026-66882 Reflected XSS in AshAuthentication confirmation and magic link interaction forms CWE-79 2.1 Low 2026-08-25
CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching CWE-290 - - 2026-06-15
CVE-2025-32782 Ash Authentication email link auto-click account confirmation vulnerability CWE-306 5.3 Medium 2025-04-15
CVE-2025-25202 Ash Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install` CWE-269 8.2 - 2025-02-11

All 20 known CVE vulnerabilities affecting ash_authentication with full Chinese analysis, references, and POCs where available.