Skip to content
OpenAdvisories

Package · Hex

ash_authentication

24 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-81637

    Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

    Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plu…

    team-alembic ash_authentication ash_authentication Hex
  • Low 1.8
    CVE-2026-82759

    Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

    Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit log add-on's :hash privacy mode is meant to pseudonymise. AshAuthentication.AddOn…

    team-alembic ash_authentication ash_authentication Hex
  • Low 1.8
    CVE-2026-82723

    Actor record with password digest stored in AshAuthentication audit log entries

    Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store. The audit_log add-on builds each entry's extra_data in AshAuthentication.AddOn.AuditLog.…

    team-alembic ash_authentication ash_authentication Hex
  • Low 2.1
    CVE-2026-66882

    Reflected XSS in AshAuthentication confirmation and magic link interaction forms

    Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms. When a strategy is configured with require_interacti…

    team-alembic ash_authentication ash_authentication Hex