# cve.now: Team-alembic

The newest entries naming Team-alembic as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-110826](https://cve.now/CVE-2026-110826.md): AshAuthentication log\_out\_everywhere leaves sessions valid after a password reset or non-atomic password change (CVSS 6.3)
- [CVE-2026-118505](https://cve.now/CVE-2026-118505.md): AshAuthentication brute\_force\_strategy does not limit sign-in and request actions defined on the resource (CVSS 6.3)
- [CVE-2026-119215](https://cve.now/CVE-2026-119215.md): AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account (CVSS 7.6)
- [CVE-2026-86688](https://cve.now/CVE-2026-86688.md): Session id is not renewed on authentication in ash\_authentication, allowing session fixation (CVSS 7.4)
- [CVE-2026-76949](https://cve.now/CVE-2026-76949.md): Remember-me sign-in guard reads a session key that is never written in ash\_authentication, allowing session replacement (CVSS 9.1)
- [CVE-2026-91039](https://cve.now/CVE-2026-91039.md): dynamic\_oidc identities are not namespaced by connection in ash\_authentication, allowing cross-connection account takeover (CVSS 9.1)
- [CVE-2026-88952](https://cve.now/CVE-2026-88952.md): OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication (CVSS 9.1)
- [CVE-2026-85500](https://cve.now/CVE-2026-85500.md): \`require\_confirmed\_with\` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication (CVSS 9.1)
- [CVE-2026-86533](https://cve.now/CVE-2026-86533.md): Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix (CVSS 9.1)
- [CVE-2026-81632](https://cve.now/CVE-2026-81632.md): Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix (CVSS 7.2)
- [CVE-2026-80218](https://cve.now/CVE-2026-80218.md): Sign-in token minted for one resource accepted by another in AshAuthentication (CVSS 7.6)
- [CVE-2026-78223](https://cve.now/CVE-2026-78223.md): Token revocation record built from unverified JWT claims in AshAuthentication (CVSS 6.9)
- [CVE-2026-86522](https://cve.now/CVE-2026-86522.md): Log injection via an unescaped password reset identity in AshAuthentication (CVSS 6.3)
- [CVE-2026-81637](https://cve.now/CVE-2026-81637.md): Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication (CVSS 2.3)
- [CVE-2026-82761](https://cve.now/CVE-2026-82761.md): Magic link single-use tokens replayable via TOCTOU race in AshAuthentication (CVSS 9.1)
- [CVE-2026-82685](https://cve.now/CVE-2026-82685.md): Confirmation token accepted on any record in AshAuthentication (CVSS 7.6)
- [CVE-2026-82760](https://cve.now/CVE-2026-82760.md): Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in (CVSS 8.2)
- [CVE-2026-82759](https://cve.now/CVE-2026-82759.md): Reversible IP address pseudonymisation in AshAuthentication audit log hash mode (CVSS 1.8)
- [CVE-2026-82723](https://cve.now/CVE-2026-82723.md): Actor record with password digest stored in AshAuthentication audit log entries (CVSS 1.8)
- [CVE-2026-65633](https://cve.now/CVE-2026-65633.md): Purpose-limited JWT accepted as full bearer authentication in AshAuthentication (CVSS 7.6)
- [CVE-2026-66882](https://cve.now/CVE-2026-66882.md): Reflected XSS in AshAuthentication confirmation and magic link interaction forms (CVSS 2.1)
- [CVE-2026-49757](https://cve.now/CVE-2026-49757.md): OAuth2/OIDC account takeover in AshAuthentication via email-based user matching (CVSS 9.2)
- [CVE-2025-4754](https://cve.now/CVE-2025-4754.md): Missing Session Revocation on Logout in ash\_authentication\_phoenix (CVSS 2.3)
- [CVE-2025-32782](https://cve.now/CVE-2025-32782.md): Ash Authentication email link auto-click account confirmation vulnerability (CVSS 5.3)
- [CVE-2025-25202](https://cve.now/CVE-2025-25202.md): Ash Authentication has flawed token revocation checking logic in actions generated by \`mix ash\_authentication.install\` (CVSS 6.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/team-alembic
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.