@stackflag.bsky.socialCVE-2026-86688 - ash_authentication
The Ash Authentication library does not create a new session ID when a user logs in, so a malicious party who places a session ID in a victim’s browser…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-76949 - ash_authentication
The ash_authentication component used in your applications can be tricked into swapping a legitimate user’s logged‑in session with the attacker’s own…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-91039 - ash_authentication
The ash_authentication library does not keep user accounts separate for each OpenID Connect connection, so a login from one connection can be used to…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-88952 - ash_authentication
The AshAuthentication login library can link a third‑party account to the wrong local account because it does not verify that the email addresses match.…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-85500 - ash_authentication
The AshAuthentication library does not properly enforce email confirmation, so a user who has not confirmed their address can still obtain a session.…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-86533 - ash_authentication_phoenix
The login system used by the AshAuthentication and AshAuthentication Phoenix libraries does not verify that a session has been revoked when a user logs out. As a…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-82761 - ash_authentication
The AshAuthentication library lets a magic link be used more than once if two login attempts happen at the same time. This means someone who obtains a…
Too many irrelevant or confusing CVEs? Use stackflag.com