# ash\_authentication (Hex) vulnerabilities 24 known vulnerabilities (7 critical, 7 high, 6 medium, 4 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://hex.pm/packages/ash_authentication ## Advisories (24) ### [CVE-2026-110826](https://cve.now/CVE-2026-110826): AshAuthentication log\_out\_everywhere leaves sessions valid after a password reset or non-atomic password change - Severity: Medium 6.3 - Published: Nov 3, 2026 - Affected: from 4.5.0, fixed in 4.15.1; from 5.0.0-rc.0, fixed in 5.0.0-rc.16; from 4.5.0, fixed in 4.15.1; from 5.0.0-rc.0, fixed in 5.0.0-rc.16. ### [CVE-2026-118505](https://cve.now/CVE-2026-118505): AshAuthentication brute\_force\_strategy does not limit sign-in and request actions defined on the resource - Severity: Medium 6.3 - Published: Nov 3, 2026 - Affected: from 5.0.0-rc.4, fixed in 5.0.0-rc.16; from 5.0.0-rc.4, fixed in 5.0.0-rc.16. ### [CVE-2026-119215](https://cve.now/CVE-2026-119215): AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account - Severity: High 7.6 - Published: Nov 3, 2026 - Affected: from 5.0.0-rc.0, fixed in 5.0.0-rc.16; from 5.0.0-rc.0, fixed in 5.0.0-rc.16. ### [CVE-2026-86688](https://cve.now/CVE-2026-86688): Session id is not renewed on authentication in ash\_authentication, allowing session fixation - Severity: High 7.4 - Published: Sep 17, 2026 - Affected: from 0.2.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 0.2.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14. ### [CVE-2026-76949](https://cve.now/CVE-2026-76949): Remember-me sign-in guard reads a session key that is never written in ash\_authentication, allowing session replacement - Severity: Critical 9.1 - Published: Sep 17, 2026 - Affected: from 4.10.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 4.10.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14. ### [CVE-2026-91039](https://cve.now/CVE-2026-91039): dynamic\_oidc identities are not namespaced by connection in ash\_authentication, allowing cross-connection account takeover - Severity: Critical 9.1 - Published: Sep 17, 2026 - Affected: from 5.0.0-rc.10, fixed in 5.0.0-rc.14; from 5.0.0-rc.10, fixed in 5.0.0-rc.14. ### [CVE-2026-88952](https://cve.now/CVE-2026-88952): OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication - Severity: Critical 9.1 - Published: Sep 17, 2026 - Affected: from 4.14.0, fixed in 4.15.0; from 5.0.0-rc.10, fixed in 5.0.0-rc.14; from 4.14.0, fixed in 4.15.0; from 5.0.0-rc.10, fixed in 5.0.0-rc.14. ### [CVE-2026-85500](https://cve.now/CVE-2026-85500): \`require\_confirmed\_with\` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication - Severity: Critical 9.1 - Published: Sep 17, 2026 - Affected: from 4.3.8, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 4.3.8, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14. ### [CVE-2026-86533](https://cve.now/CVE-2026-86533): Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix - Severity: Critical 9.1 - Published: Sep 17, 2026 - Affected: from 4.9.1, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 4.9.1, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14. ### [CVE-2026-81632](https://cve.now/CVE-2026-81632): Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix - Severity: High 7.2 - Published: Sep 17, 2026 - Affected: from 3.10.5, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 3.10.5, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14. ### [CVE-2026-80218](https://cve.now/CVE-2026-80218): Sign-in token minted for one resource accepted by another in AshAuthentication - Severity: High 7.6 - Published: Sep 17, 2026 - Affected: from 3.10.5, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 3.10.5, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14. ### [CVE-2026-78223](https://cve.now/CVE-2026-78223): Token revocation record built from unverified JWT claims in AshAuthentication - Severity: Medium 6.9 - Published: Sep 17, 2026 - Affected: from 0.2.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 0.2.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14. ### [CVE-2026-86522](https://cve.now/CVE-2026-86522): Log injection via an unescaped password reset identity in AshAuthentication - Severity: Medium 6.3 - Published: Sep 17, 2026 - Affected: from 4.2.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 4.2.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14. ### [CVE-2026-81637](https://cve.now/CVE-2026-81637): Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication - Severity: Low 2.3 - Published: Sep 17, 2026 - Affected: from 0.6.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 0.6.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14. ### [CVE-2026-82761](https://cve.now/CVE-2026-82761): Magic link single-use tokens replayable via TOCTOU race in AshAuthentication - Severity: Critical 9.1 - Published: Sep 17, 2026 - Affected: from 3.9.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 3.9.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14. ### [CVE-2026-82685](https://cve.now/CVE-2026-82685): Confirmation token accepted on any record in AshAuthentication - Severity: High 7.6 - Published: Sep 17, 2026 - Affected: from 0.5.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 0.5.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14. ### [CVE-2026-82760](https://cve.now/CVE-2026-82760): Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in - Severity: High 8.2 - Published: Sep 17, 2026 - Affected: from 4.8.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 4.8.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14. ### [CVE-2026-82759](https://cve.now/CVE-2026-82759): Reversible IP address pseudonymisation in AshAuthentication audit log hash mode - Severity: Low 1.8 - Published: Sep 17, 2026 - Affected: from 4.12.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14; from 4.12.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.14. ### [CVE-2026-82723](https://cve.now/CVE-2026-82723): Actor record with password digest stored in AshAuthentication audit log entries - Severity: Low 1.8 - Published: Sep 17, 2026 - Affected: from 4.12.0, fixed in 4.15.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.2. ### [CVE-2026-65633](https://cve.now/CVE-2026-65633): Purpose-limited JWT accepted as full bearer authentication in AshAuthentication - Severity: High 7.6 - Published: Aug 25, 2026 - Affected: from 3.10.5, fixed in 4.14.2; from 5.0.0-rc.0, fixed in 5.0.0-rc.13; from 3.10.5, fixed in 4.14.2; from 5.0.0-rc.0, fixed in 5.0.0-rc.13. ### [CVE-2026-66882](https://cve.now/CVE-2026-66882): Reflected XSS in AshAuthentication confirmation and magic link interaction forms - Severity: Low 2.1 - Published: Aug 25, 2026 - Affected: from 4.8.0, fixed in 4.14.2; from 5.0.0-rc.0, fixed in 5.0.0-rc.13; from 4.8.0, fixed in 4.14.2; from 5.0.0-rc.0, fixed in 5.0.0-rc.13. ### [CVE-2026-49757](https://cve.now/CVE-2026-49757): OAuth2/OIDC account takeover in AshAuthentication via email-based user matching - Severity: Critical 9.2 - Published: Jun 15, 2026 - Affected: from 0.1.0, fixed in 4.14.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.10; from 0.1.0, fixed in 4.14.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.10; from 0.1.0, fixed in 4.14.0; from 5.0.0-rc.0, fixed in 5.0.0-rc.10. ### [CVE-2025-32782](https://cve.now/CVE-2025-32782): Ash Authentication email link auto-click account confirmation vulnerability - Severity: Medium 5.3 - Published: Apr 15, 2025 - Affected: fixed in 4.7.0. ### [CVE-2025-25202](https://cve.now/CVE-2025-25202): Ash Authentication has flawed token revocation checking logic in actions generated by \`mix ash\_authentication.install\` - Severity: Medium 6.3 - Published: Feb 11, 2025 - Affected: from 4.1.0, fixed in 4.4.9. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/hex/ash_authentication Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.