Skip to content
OpenAdvisories

Package · Hex

ash_authentication_phoenix

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.1
    CVE-2026-86533

    Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

    Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_authenticat…

    team-alembic ash_authentication ash_authentication_phoenix ash_authentication Hex
  • High 7.2
    CVE-2026-81632

    Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

    Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successf…

    team-alembic ash_authentication ash_authentication_phoenix ash_authentication Hex
  • Low 2.3
    CVE-2025-4754

    Missing Session Revocation on Logout in ash_authentication_phoenix

    Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application'…

    team-alembic ash_authentication_phoenix ash_authentication_phoenix Hex