ash_authentication
- Software type
- Software application
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/07/2026, ash_authentication recorded 21 security vulnerabilities in the last 90 days, of which 13 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of ash_authentication and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's accountCVE-2026-118505AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resourceCVE-2026-110826AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password changeCVE-2026-91039dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeoverCVE-2026-88952OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-118505AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource | Exploitation statusNot exploited | FixYes | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-110826AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change | Exploitation statusNot exploited | FixYes | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-91039dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityCritical |
|---|
CVE-2026-88952OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityCritical |
|---|
CVE-2026-86688Session id is not renewed on authentication in ash_authentication, allowing session fixation | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-86533Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityCritical |
|---|
CVE-2026-86522Log injection via an unescaped password reset identity in AshAuthentication | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityMedium |
|---|
CVE-2026-85500`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityCritical |
|---|
CVE-2026-82761Magic link single-use tokens replayable via TOCTOU race in AshAuthentication | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityCritical |
|---|
CVE-2026-82760Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-82759Reversible IP address pseudonymisation in AshAuthentication audit log hash mode | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityLow |
|---|
CVE-2026-82723Actor record with password digest stored in AshAuthentication audit log entries | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityLow |
|---|
CVE-2026-82685Confirmation token accepted on any record in AshAuthentication | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-81637Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityLow |
|---|
CVE-2026-81632Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-80218Sign-in token minted for one resource accepted by another in AshAuthentication | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-78223Token revocation record built from unverified JWT claims in AshAuthentication | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityMedium |
|---|
CVE-2026-76949Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityCritical |
|---|
CVE-2026-66882Reflected XSS in AshAuthentication confirmation and magic link interaction forms | Exploitation statusActively exploited | FixYes | Published08/25/2026 | SeverityLow |
|---|
CVE-2026-65633Purpose-limited JWT accepted as full bearer authentication in AshAuthentication | Exploitation statusActively exploited | FixYes | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-49757OAuth2/OIDC account takeover in AshAuthentication via email-based user matching | Exploitation statusActively exploited | FixYes | Published06/15/2026 | SeverityCritical |
|---|
CVE-2025-32782Ash Authentication email link auto-click account confirmation vulnerability | Exploitation statusNot exploited | FixYes | Published04/15/2025 | SeverityMedium |
|---|
CVE-2025-25202Ash Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install` | Exploitation statusActively exploited | FixYes | Published02/11/2025 | SeverityMedium |
|---|
24 Results | Page 1 of 1