Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

ash_authentication

24 known vulnerabilities (7 critical, 7 high, 6 medium, 4 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
24 · 7 critical, 7 high, 6 medium, 4 low
Registry
Hex

Advisories 24

  • CVE-2026-110826Medium 6.3

    AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change

    Affected: from 4.5.0, fixed in 4.15.1; from 5.0.0-rc.0, fixed in 5.0.0-rc.16; from 4.5.0, fixed in 4.15.1; from 5.0.0-rc.0, fixed in 5.0.0-rc.16.

  • CVE-2026-118505Medium 6.3

    AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource

    Affected: from 5.0.0-rc.4, fixed in 5.0.0-rc.16; from 5.0.0-rc.4, fixed in 5.0.0-rc.16.

  • AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account

    Affected: from 5.0.0-rc.0, fixed in 5.0.0-rc.16; from 5.0.0-rc.0, fixed in 5.0.0-rc.16.

  • Session id is not renewed on authentication in ash_authentication, allowing session fixation

    Affected: from 0.2.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 0.2.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14.

  • CVE-2026-76949Critical 9.1

    Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

    Affected: from 4.10.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 4.10.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14.

  • CVE-2026-91039Critical 9.1

    dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

    Affected: from 5.0.0-rc.10, fixed in 5.0.0-rc.14; from 5.0.0-rc.10, fixed in 5.0.0-rc.14.

  • CVE-2026-88952Critical 9.1

    OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

    Affected: from 4.14.0, fixed in 4.15.0; from 5.0.0-rc.10, fixed in 5.0.0-rc.14; from 4.14.0, fixed in 4.15.0; from 5.0.0-rc.10, fixed in 5.0.0-rc.14.

  • CVE-2026-85500Critical 9.1

    `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication

    Affected: from 4.3.8, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 4.3.8, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14.

  • CVE-2026-86533Critical 9.1

    Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

    Affected: from 4.9.1, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 4.9.1, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14.

  • Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

    Affected: from 3.10.5, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 3.10.5, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14.

  • Sign-in token minted for one resource accepted by another in AshAuthentication

    Affected: from 3.10.5, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 3.10.5, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14.

  • CVE-2026-78223Medium 6.9

    Token revocation record built from unverified JWT claims in AshAuthentication

    Affected: from 0.2.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 0.2.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14.

  • CVE-2026-86522Medium 6.3

    Log injection via an unescaped password reset identity in AshAuthentication

    Affected: from 4.2.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 4.2.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14.

  • Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

    Affected: from 0.6.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 0.6.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14.

  • CVE-2026-82761Critical 9.1

    Magic link single-use tokens replayable via TOCTOU race in AshAuthentication

    Affected: from 3.9.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 3.9.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14.

Show all 24 advisoriesShow fewer advisories

  • Confirmation token accepted on any record in AshAuthentication

    Affected: from 0.5.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 0.5.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14.

  • Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in

    Affected: from 4.8.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 4.8.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14.

  • Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

    Affected: from 4.12.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 4.12.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14.

  • Actor record with password digest stored in AshAuthentication audit log entries

    Affected: from 4.12.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.2.

  • Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

    Affected: from 3.10.5, fixed in 4.14.2; from 5.0.0-rc.0, fixed in 5.0.0-rc.13; from 3.10.5, fixed in 4.14.2; from 5.0.0-rc.0, fixed in 5.0.0-rc.13.

  • Reflected XSS in AshAuthentication confirmation and magic link interaction forms

    Affected: from 4.8.0, fixed in 4.14.2; from 5.0.0-rc.0, fixed in 5.0.0-rc.13; from 4.8.0, fixed in 4.14.2; from 5.0.0-rc.0, fixed in 5.0.0-rc.13.

  • CVE-2026-49757Critical 9.2

    OAuth2/OIDC account takeover in AshAuthentication via email-based user matching

    Affected: from 0.1.0, fixed in 4.14.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.10; from 0.1.0, fixed in 4.14.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.10; from 0.1.0, fixed in 4.14.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.10.

  • CVE-2025-32782Medium 5.3

    Ash Authentication email link auto-click account confirmation vulnerability

    Affected: fixed in 4.7.0.

  • CVE-2025-25202Medium 6.3

    Ash Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install`

    Affected: from 4.1.0, fixed in 4.4.9.