team-alembic
- Total products in the ecosystem
- 2
- Total vulnerabilities (90 days)
- 21
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, team-alembic recorded 21 security vulnerabilities in the last 90 days across 2 products, including 13 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, ash_authentication had the most security vulnerabilities in the team-alembic ecosystem, with 21 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's accountCVE-2026-118505AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resourceCVE-2026-110826AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password changeCVE-2026-91039dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeoverCVE-2026-88952OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account | Exploitation statusNot exploited | FixYes |
| Affected productash_authentication |
| Published11/03/2026 |
| SeverityHigh |
CVE-2026-118505AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-110826AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-91039dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityCritical |
|---|
CVE-2026-88952OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityCritical |
|---|
CVE-2026-86688Session id is not renewed on authentication in ash_authentication, allowing session fixation | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-86533Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityCritical |
|---|
CVE-2026-86522Log injection via an unescaped password reset identity in AshAuthentication | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityMedium |
|---|
CVE-2026-85500`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityCritical |
|---|
CVE-2026-82761Magic link single-use tokens replayable via TOCTOU race in AshAuthentication | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityCritical |
|---|
CVE-2026-82760Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-82759Reversible IP address pseudonymisation in AshAuthentication audit log hash mode | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityLow |
|---|
CVE-2026-82723Actor record with password digest stored in AshAuthentication audit log entries | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityLow |
|---|
CVE-2026-82685Confirmation token accepted on any record in AshAuthentication | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-81637Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityLow |
|---|
CVE-2026-81632Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-80218Sign-in token minted for one resource accepted by another in AshAuthentication | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-78223Token revocation record built from unverified JWT claims in AshAuthentication | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityMedium |
|---|
CVE-2026-76949Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published09/17/2026 | SeverityCritical |
|---|
CVE-2026-66882Reflected XSS in AshAuthentication confirmation and magic link interaction forms | Exploitation statusActively exploited | FixYes | Affected productash_authentication | Published08/25/2026 | SeverityLow |
|---|
CVE-2026-65633Purpose-limited JWT accepted as full bearer authentication in AshAuthentication | Exploitation statusActively exploited | FixYes | Affected productash_authentication | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-49757OAuth2/OIDC account takeover in AshAuthentication via email-based user matching | Exploitation statusActively exploited | FixYes | Affected productash_authentication | Published06/15/2026 | SeverityCritical |
|---|
CVE-2025-4754Missing Session Revocation on Logout in ash_authentication_phoenix | Exploitation statusNot exploited | FixYes | Affected productash_authentication_phoenix | Published06/17/2025 | SeverityLow |
|---|
CVE-2025-32782Ash Authentication email link auto-click account confirmation vulnerability | Exploitation statusNot exploited | FixYes | Affected productash_authentication | Published04/15/2025 | SeverityMedium |
|---|
CVE-2025-25202Ash Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install` | Exploitation statusActively exploited | FixYes | Affected productash_authentication | Published02/11/2025 | SeverityMedium |
|---|
25 Results | Page 1 of 1