Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

ash_authentication_phoenix

3 known vulnerabilities (1 critical, 1 high, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 1 critical, 1 high, 1 low
Registry
Hex

Advisories 3

  • CVE-2026-86533Critical 9.1

    Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

    Affected: from 2.10.0, fixed in 2.17.4; from 3.0.0-rc.0, fixed in 3.0.0-rc.11; from 2.10.0, fixed in 2.17.4; from 3.0.0-rc.0, fixed in 3.0.0-rc.11.

  • Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

    Affected: from 1.7.0, fixed in 2.17.4; from 3.0.0-rc.0, fixed in 3.0.0-rc.11; from 1.7.0, fixed in 2.17.4; from 3.0.0-rc.0, fixed in 3.0.0-rc.11.

  • Missing Session Revocation on Logout in ash_authentication_phoenix

    Affected: from 0.1.0, fixed in 2.10.0; fixed in 2.10.0; from 0.1.0, fixed in 2.10.0.