These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-91039 is an Authentication Bypass by Spoofing vulnerability in the ash_authentication library. The vulnerability allows an attacker to sign in as a local user established through a different connection by operating one identity-provider connection of a dynamic_oidc strategy. This issue arises from a naming conflict in the dynamic_oidc strategy, which fails to properly namespace connections, there [truncated]
CVE-2026-88952 Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. The vulnerability arises from AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matching an existing account using the register action's upsert_identity keys, then gates linking the incoming provider [truncated]
CVE-2026-86533 Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither r [truncated]
CVE-2026-86522 Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters. The vulnerability arises from AshAuthentication.Strategy.Password.RequestPasswordReset.run/3 interpolating the identity argument into its Logger.warning/1 [truncated]
CVE-2026-85500 is an Authentication Bypass by Primary Weakness vulnerability in the AshAuthentication library. An unconfirmed user can obtain a session, bypassing the mandatory email confirmation requirement. The vulnerability arises from the AshAuthentication.Strategy.Password.Actions.check_user/2 function, which decides whether the attribute named by require_confirmed_with is set using a bare is_nil(Map [truncated]
A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. The vulnerability arises from a race condition between the verification and revocation of single-use tokens, which can lead to unauthorized access and sensitive information disclosure. Defen [truncated]
An Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key. The vulnerability affects ash_authentication versions from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. This issue can lead to denial-of-service conditions, emphasizing the need for defender [truncated]
CVE-2026-82759 debrief: Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover client IP addresses that the audit log add-on's :hash privacy mode is meant to pseudonymise. The vulnerability arises from the use of a predictable salt in the :hash privacy mode, which enables the recovery of client IP addresses. This issue aff [truncated]
CVE-2026-82723 is an Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication. The vulnerability allows disclosure of user password digests to readers of the audit store. This issue affects ash_authentication: from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.2. The vulnerability arises from the audit_log add-on in AshAuthentication.AddOn.AuditLog.Audito [truncated]
CVE-2026-82685 debrief based on the supplied source corpus. The vulnerability is an Authorization Bypass Through User-Controlled Key issue in the team-alembic AshAuthentication library, allowing an authenticated attacker to overwrite and confirm another user's email address, potentially taking over that account. Affected versions of the library include ash_authentication from 0.5.0 before 4.15.0 and from [truncated]
CVE-2026-81637 Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. This vulnerability affects ash_authentication versions from 0.6.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. The vulnerability allows an attacker to replay the [truncated]
CVE-2026-81632 debrief: AshAuthenticationPhoenix vulnerability allows token recovery from access logs, proxy logs, or browser history. The vulnerability exists in the AshAuthenticationPhoenix library, which uses a single-use sign-in token as a query parameter in a GET request. This token can be recorded in access logs, proxy logs, and browser history, allowing an attacker with access to these logs or hist [truncated]
CVE-2026-80218 Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. The vulnerability arises from AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extract_primary_keys_from_subject/2, which improperly handles JWT sub claims, allowing an attacker to s [truncated]
CVE-2026-78223 Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. The vulnerability affects ash_authentication versions from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Defenders should assess exposure and verify token auth [truncated]
The CVE-2026-66882 vulnerability is a reflected cross-site scripting (XSS) vulnerability in the AshAuthentication library. This occurs when a strategy is configured with require_interaction? set to true, allowing an attacker to craft a URL that injects malicious code into the page. The vulnerability affects versions 4.8.0 to 4.14.2 and 5.0.0-rc.0 to 5.0.0-rc.13 of the ash_authentication library. To addres [truncated]
The CVE-2026-65633 Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resource uses stateless bearer-token verification. This vulnerability affects ash_authentication from 3.10.5 before 4.14.2 and from 5.0.0-rc.0 before 5.0.0-rc.13. The vulnerability can be exploited by an attacker who obtains a not-yet-e [truncated]
CVE-2026-49757 debrief based on the supplied source corpus. The CVE record was published on 2026-06-15T12:16:25.777Z and has not been modified since then. The Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. Affected product deployments should be verified for exposure, and owners should prioritize verification [truncated]
