The CVE-2026-64941 vulnerability is classified as a URL Redirection to Untrusted Site (Open Redirect) issue within the phoenix_live_view library. This vulnerability allows an attacker to redirect a victim's browser to an arbitrary URL by exploiting a weakness in the validation of the :to value in the redirect/2 function. The validation mechanism fails to properly handle ASCII tab, LF, or CR characters, wh [truncated]
A cross-site scripting vulnerability exists in phoenixframework phoenix_live_view, allowing an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The issue arises from the way the Phoenix.LiveView.Utils.valid_destination!/2 and Phoenix.LiveView.Utils.valid_live_navigation_destination!/2 functions handle URL inputs. Specifically, the internal uri_scheme/1 helper [truncated]
CVE-2026-56812 is an Improper Check for Unusual or Exceptional Conditions vulnerability in the Phoenix JavaScript presence client. An attacker with ordinary channel access can cause a persistent client-side denial of service against every viewer of a presence channel topic. The vulnerability is due to a bare truthiness test (state[key]) instead of an own-property check, allowing an attacker to control pre [truncated]
A vulnerability in the Phoenix framework's Socket module allows an unauthenticated attacker to cause a denial of service against any endpoint that mounts a Phoenix socket with a reachable channel transport (WebSocket or LongPoll). The vulnerability is due to the lack of limits on the number of channels that a single transport process may join, allowing an attacker to spawn hundreds of thousands of channel [truncated]
