7 results · Clear filters · Feed
-
Critical 9.1
Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement
Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account. AshAuthentic…
-
Critical 9.1
dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover
Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynamic_oidc strategy to be signed in as a local user established through a different connection. The stra…
-
Critical 9.1
OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication
Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an exis…
-
Critical 9.1
`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.check_user/2 decides wh…
-
Critical 9.1
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_authenticat…
-
Critical 9.1
Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with single_use_tok…
-
Critical 9.2
OAuth2/OIDC account takeover in AshAuthentication via email-based user matching
Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address (an upsert on the e…