hex ash_authentication vulnerabilities

Latest hex ash_authentication CVEs

Newest publication first

1. CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching

   Published 2026-06-15

   Critical·CVSS 9.2 EPSS 0.62%

   Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address (an upsert on the email field, or a user...

2. CVE-2025-32782 Ash Authentication email link auto-click account confirmation vulnerability

   Published 2025-04-15

   Medium·CVSS 5.3 EPSS 0.32%

   Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request triggered by clicking a link sent via email. Some email clients and security tools (e.g., Outlook, virus scanners, and email previewers) may a...

3. CVE-2025-25202 Ash Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install`

   Published 2025-02-11

   Medium·CVSS 6.3 EPSS 0.31%

   Ash Authentication is an authentication framework for Elixir applications. Applications which have been bootstrapped by the igniter installer present since AshAuthentication v4.1.0 and who have used the magic link strategy or are manually revoking tokens are affected by revoked t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.