Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

team-alembic — Vulnerabilities & Security Advisories 22

Browse all 22 CVE security advisories affecting team-alembic. AI-powered Chinese analysis, POCs, and references for each vulnerability.

This page aggregates vulnerability data specifically for the vendor team-alembic, focusing on software products and associated weakness types. The collection encompasses a comprehensive range of security flaws identified in team-alembic releases, covering a historical timeline from the earliest recorded incidents to the most recent disclosures. Users can utilize this resource to track the vendor's official security advisories, analyze the prevalence of specific weakness classes within their codebase, or examine the complete vulnerability history of individual team-alembic products. The data presented here is compiled from public sources to provide a centralized view of security risks, enabling security professionals and researchers to assess the long-term stability and safety of team-alembic solutions. By organizing these records chronologically and categorizing them by impact and type, the page facilitates efficient risk analysis and remediation planning without requiring cross-referencing of multiple disparate databases. This aggregation supports informed decision-making for organizations deploying team-alembic technologies by highlighting recurring issues and tracking the vendor's response patterns over time. The information remains strictly factual, avoiding promotional language to ensure an objective assessment of the security posture associated with this specific vendor.

CVE ID Title CVSS Severity Published
CVE-2026-86688 Session id is not renewed on authentication in ash_authentication, allowing session fixation — ash_authentication CWE-384 7.4 High 2026-09-17
CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement — ash_authentication CWE-290 9.1 Critical 2026-09-17
CVE-2026-91039 dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover — ash_authentication CWE-290 9.1 Critical 2026-09-17
CVE-2026-88952 OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication — ash_authentication CWE-287 9.1 Critical 2026-09-17
CVE-2026-85500 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication — ash_authentication CWE-305 9.1 Critical 2026-09-17
CVE-2026-86533 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix — ash_authentication CWE-613 9.1 Critical 2026-09-17
CVE-2026-81632 Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix — ash_authentication_phoenix CWE-598 7.2 High 2026-09-17
CVE-2026-80218 Sign-in token minted for one resource accepted by another in AshAuthentication — ash_authentication CWE-287 7.6 High 2026-09-17
CVE-2026-78223 Token revocation record built from unverified JWT claims in AshAuthentication — ash_authentication CWE-347 6.9 Medium 2026-09-17
CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication — ash_authentication CWE-117 6.3 Medium 2026-09-17
CVE-2026-81637 Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication — ash_authentication CWE-613 2.3 Low 2026-09-17
CVE-2026-82761 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication — ash_authentication CWE-367 9.1 Critical 2026-09-17
CVE-2026-82685 Confirmation token accepted on any record in AshAuthentication — ash_authentication CWE-639 7.6 High 2026-09-17
CVE-2026-82760 Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in — ash_authentication CWE-407 8.2 High 2026-09-17
CVE-2026-82759 Reversible IP address pseudonymisation in AshAuthentication audit log hash mode — ash_authentication CWE-760 1.8 Low 2026-09-17
CVE-2026-82723 Actor record with password digest stored in AshAuthentication audit log entries — ash_authentication CWE-532 1.8 Low 2026-09-17
CVE-2026-65633 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication — ash_authentication CWE-287 7.6 High 2026-08-25
CVE-2026-66882 Reflected XSS in AshAuthentication confirmation and magic link interaction forms — ash_authentication CWE-79 2.1 Low 2026-08-25
CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching — ash_authentication CWE-290 - - 2026-06-15
CVE-2025-4754 Missing Session Revocation on Logout in ash_authentication_phoenix — ash_authentication_phoenix CWE-613 2.3 Low 2025-06-17
CVE-2025-32782 Ash Authentication email link auto-click account confirmation vulnerability — ash_authentication CWE-306 5.3 Medium 2025-04-15
CVE-2025-25202 Ash Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install` — ash_authentication CWE-269 8.2 - 2025-02-11

This page lists every published CVE security advisory associated with team-alembic. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.