Vulnerabilidades en team-alembic
22 resultadosCVE-2026-86533CRITICALRevoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication PhoenixEPSS 0.9%CVE-2026-76949CRITICALRemember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacementEPSS 0.8%CVE-2026-85500CRITICAL`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthenticationEPSS 0.8%CVE-2026-66882LOWReflected XSS in AshAuthentication confirmation and magic link interaction formsEPSS 0.8%CVE-2026-88952CRITICALOAuth2 sign-in attached to an existing account without an email comparison in AshAuthenticationEPSS 0.7%CVE-2026-86688HIGHSession id is not renewed on authentication in ash_authentication, allowing session fixationEPSS 0.7%CVE-2026-86522MEDIUMLog injection via an unescaped password reset identity in AshAuthenticationEPSS 0.7%CVE-2026-82760HIGHSuperlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-inEPSS 0.7%CVE-2026-49757CRITICALOAuth2/OIDC account takeover in AshAuthentication via email-based user matchingEPSS 0.7%CVE-2026-82685HIGHConfirmation token accepted on any record in AshAuthenticationEPSS 0.7%CVE-2026-91039CRITICALdynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeoverEPSS 0.7%CVE-2026-80218HIGHSign-in token minted for one resource accepted by another in AshAuthenticationEPSS 0.6%CVE-2026-81637LOWReplayable OAuth2 CSRF state retained after a failed callback in AshAuthenticationEPSS 0.6%CVE-2026-65633HIGHPurpose-limited JWT accepted as full bearer authentication in AshAuthenticationEPSS 0.6%CVE-2026-82761CRITICALMagic link single-use tokens replayable via TOCTOU race in AshAuthenticationEPSS 0.6%CVE-2025-4754LOWMissing Session Revocation on Logout in ash_authentication_phoenixEPSS 0.5%CVE-2026-78223MEDIUMToken revocation record built from unverified JWT claims in AshAuthenticationEPSS 0.4%CVE-2025-32782MEDIUMAsh Authentication email link auto-click account confirmation vulnerabilityEPSS 0.3%CVE-2025-25202MEDIUMAsh Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install`EPSS 0.3%CVE-2026-81632HIGHSingle-use sign-in token placed in a redirect query string in AshAuthenticationPhoenixEPSS 0.2%