team-alembic vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 202622

Newest CVEs

• CVE-2026-110826

  AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change

  team-alembic · ash_authentication

  Medium6.3
• CVE-2026-118505

  AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource

  team-alembic · ash_authentication

  Medium6.3
• CVE-2026-119215

  AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account

  team-alembic · ash_authentication

  High7.6
• CVE-2026-86688

  Session id is not renewed on authentication in ash_authentication, allowing session fixation

  team-alembic · ash_authentication

  High7.4
• CVE-2026-76949

  Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

  team-alembic · ash_authentication

  Critical9.1
• CVE-2026-91039

  dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

  team-alembic · ash_authentication

  Critical9.1
• CVE-2026-88952

  OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

  team-alembic · ash_authentication

  Critical9.1
• CVE-2026-85500

  `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication

  team-alembic · ash_authentication

  Critical9.1
• CVE-2026-86533

  Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

  team-alembic · ash_authentication

  Critical9.1
• CVE-2026-81632

  Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

  team-alembic · ash_authentication_phoenix

  High7.2