.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

ash_authentication 5.0.0-rc.2 vulnerabilities

24 advisories known · ash_authentication@5.0.0-rc.2 · 18 affect this release · Dependencies not checked

SEVERITYADVISORYPUBLISHED

Affects 5.0.0-rc.2

SEVERITYADVISORYPUBLISHED

CriticalAshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matchingGHSA-777c-2fxx-qr28CVE-2026-49757EEF-CVE-2026-49757Affected >=0.1.0 <4.14.0, >=5.0.0-rc.0 <5.0.0-rc.10Fixed in 4.14.0 Fixed in 5.0.0-rc.10OSV source ↗5 months ago

UnknownAshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password changeEEF-CVE-2026-110826CVE-2026-110826GHSA-j6f8-qcj9-gh4rAffected >=4.5.0 <4.15.1, >=5.0.0-rc.0 <5.0.0-rc.16Fixed in 4.15.1 Fixed in 5.0.0-rc.16OSV source ↗7 days ago

UnknownAshAuthentication TOTP setup lets a user install their own authenticator secret on another user's accountEEF-CVE-2026-119215CVE-2026-119215GHSA-gx67-694c-655cAffected >=5.0.0-rc.0 <5.0.0-rc.16Fixed in 5.0.0-rc.16OSV source ↗7 days ago

UnknownSession id is not renewed on authentication in ash_authentication, allowing session fixationEEF-CVE-2026-86688CVE-2026-86688GHSA-v577-944g-7h3xAffected >=0.2.0 <4.15.0, >=5.0.0-rc.0 <5.0.0-rc.14Fixed in 4.15.0 Fixed in 5.0.0-rc.14OSV source ↗2 months ago

UnknownRemember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacementEEF-CVE-2026-76949CVE-2026-76949GHSA-hh34-374j-pfr5Affected >=4.10.0 <4.15.0, >=5.0.0-rc.0 <5.0.0-rc.14Fixed in 4.15.0 Fixed in 5.0.0-rc.14OSV source ↗2 months ago

Unknown`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthenticationEEF-CVE-2026-85500CVE-2026-85500GHSA-fc47-6pgw-wh22Affected >=4.3.8 <4.15.0, >=5.0.0-rc.0 <5.0.0-rc.14Fixed in 4.15.0 Fixed in 5.0.0-rc.14OSV source ↗2 months ago

UnknownRevoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication PhoenixEEF-CVE-2026-86533CVE-2026-86533GHSA-m6x4-4gvp-xwjrAffected >=4.9.1 <4.15.0, >=5.0.0-rc.0 <5.0.0-rc.14Fixed in 4.15.0 Fixed in 5.0.0-rc.14OSV source ↗2 months ago

UnknownSingle-use sign-in token placed in a redirect query string in AshAuthenticationPhoenixEEF-CVE-2026-81632CVE-2026-81632GHSA-8jh5-339h-mqx9Affected >=3.10.5 <4.15.0, >=5.0.0-rc.0 <5.0.0-rc.14Fixed in 4.15.0 Fixed in 5.0.0-rc.14OSV source ↗2 months ago

UnknownSign-in token minted for one resource accepted by another in AshAuthenticationEEF-CVE-2026-80218CVE-2026-80218GHSA-3pr8-f99q-86hpAffected >=3.10.5 <4.15.0, >=5.0.0-rc.0 <5.0.0-rc.14Fixed in 4.15.0 Fixed in 5.0.0-rc.14OSV source ↗2 months ago

UnknownToken revocation record built from unverified JWT claims in AshAuthenticationEEF-CVE-2026-78223CVE-2026-78223GHSA-mfwg-5cpf-px58Affected >=0.2.0 <4.15.0, >=5.0.0-rc.0 <5.0.0-rc.14Fixed in 4.15.0 Fixed in 5.0.0-rc.14OSV source ↗2 months ago

UnknownLog injection via an unescaped password reset identity in AshAuthenticationEEF-CVE-2026-86522CVE-2026-86522GHSA-wg7g-r393-vr3gAffected >=4.2.0 <4.15.0, >=5.0.0-rc.0 <5.0.0-rc.14Fixed in 4.15.0 Fixed in 5.0.0-rc.14OSV source ↗2 months ago

UnknownReplayable OAuth2 CSRF state retained after a failed callback in AshAuthenticationEEF-CVE-2026-81637CVE-2026-81637GHSA-3vcj-gxx8-3p44Affected >=0.6.0 <4.15.0, >=5.0.0-rc.0 <5.0.0-rc.14Fixed in 4.15.0 Fixed in 5.0.0-rc.14OSV source ↗2 months ago

UnknownMagic link single-use tokens replayable via TOCTOU race in AshAuthenticationEEF-CVE-2026-82761CVE-2026-82761GHSA-23gr-vcp4-r27qAffected >=3.9.0 <4.15.0, >=5.0.0-rc.0 <5.0.0-rc.14Fixed in 4.15.0 Fixed in 5.0.0-rc.14OSV source ↗2 months ago

UnknownConfirmation token accepted on any record in AshAuthenticationEEF-CVE-2026-82685CVE-2026-82685GHSA-g636-26vf-2w63Affected >=0.5.0 <4.15.0, >=5.0.0-rc.0 <5.0.0-rc.14Fixed in 4.15.0 Fixed in 5.0.0-rc.14OSV source ↗2 months ago

UnknownSuperlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-inEEF-CVE-2026-82760CVE-2026-82760GHSA-q876-xr24-2mcxAffected >=4.8.0 <4.15.0, >=5.0.0-rc.0 <5.0.0-rc.14Fixed in 4.15.0 Fixed in 5.0.0-rc.14OSV source ↗2 months ago

UnknownReversible IP address pseudonymisation in AshAuthentication audit log hash modeEEF-CVE-2026-82759CVE-2026-82759GHSA-cgqj-pcpq-xhfmAffected >=4.12.0 <4.15.0, >=5.0.0-rc.0 <5.0.0-rc.14Fixed in 4.15.0 Fixed in 5.0.0-rc.14OSV source ↗2 months ago

UnknownPurpose-limited JWT accepted as full bearer authentication in AshAuthenticationEEF-CVE-2026-65633CVE-2026-65633GHSA-6vcj-3h59-rrc3Affected >=3.10.5 <4.14.2, >=5.0.0-rc.0 <5.0.0-rc.13Fixed in 4.14.2 Fixed in 5.0.0-rc.13OSV source ↗3 months ago

UnknownReflected XSS in AshAuthentication confirmation and magic link interaction formsEEF-CVE-2026-66882CVE-2026-66882GHSA-54fc-x3hv-ffhwAffected >=4.8.0 <4.14.2, >=5.0.0-rc.0 <5.0.0-rc.13Fixed in 4.14.2 Fixed in 5.0.0-rc.13OSV source ↗3 months ago

Does not affect 5.0.0-rc.2

SEVERITYADVISORYPUBLISHED

MediumAsh Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install`GHSA-qrm9-f75w-hg4cCVE-2025-25202Affected >=4.1.0 <4.4.9Fixed in 4.4.9OSV source ↗2 years ago

Mediumash_authentication has email link auto-click account confirmation vulnerabilityGHSA-3988-q8q7-p787CVE-2025-32782Affected <4.7.0Fixed in 4.7.0OSV source ↗2 years ago

UnknownAshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resourceEEF-CVE-2026-118505CVE-2026-118505GHSA-55gf-3263-4r39Affected >=5.0.0-rc.4 <5.0.0-rc.16Fixed in 5.0.0-rc.16OSV source ↗7 days ago

Unknowndynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeoverEEF-CVE-2026-91039CVE-2026-91039GHSA-73j9-m294-fvv9Affected >=5.0.0-rc.10 <5.0.0-rc.14Fixed in 5.0.0-rc.14OSV source ↗2 months ago

UnknownOAuth2 sign-in attached to an existing account without an email comparison in AshAuthenticationEEF-CVE-2026-88952CVE-2026-88952GHSA-wc6x-276q-jrf9Affected >=4.14.0 <4.15.0, >=5.0.0-rc.10 <5.0.0-rc.14Fixed in 4.15.0 Fixed in 5.0.0-rc.14OSV source ↗2 months ago

UnknownActor record with password digest stored in AshAuthentication audit log entriesEEF-CVE-2026-82723CVE-2026-82723GHSA-59wx-q3r8-ghv4Affected >=4.12.0 <4.15.0, >=5.0.0-rc.0 <5.0.0-rc.2Fixed in 4.15.0 Fixed in 5.0.0-rc.2OSV source ↗2 months ago