CVE-2026-88952 OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action...

CVE-2026-88952

AshAuthentication (team-alembic, an Elixir authentication library) contains an improper authentication flaw in its OAuth2 sign-in flow. The UserResolver.resolve/3 function matches an existing account via upsert_identity keys but gates the link solely on the provider's email_verified boolean, neve...

CVE-2026-14850 Weak password recovery mechanism for forgotten password in MobiAPParc

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

EUVD-2026-81522

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

CVE-2026-14850 Weak password recovery mechanism for forgotten password in MobiAPParc

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

CVE-2026-81632 Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...

CVE-2026-81632

AshAuthenticationPhoenix (team-alembic), an Elixir authentication library for Phoenix, places a single-use sign-in token as a query parameter in a GET redirect after successful password authentication. The token travels in the request line, where it is retained by access logs, reverse proxies, an...

CVE-2026-81637 Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...

CVE-2026-81637 Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...

CVE-2026-81637

CVE-2026-81637 is an insufficient session expiration flaw in AshAuthentication (team-alembic, Elixir ecosystem). In AshAuthentication.Strategy.OAuth2.Plug.callback/2, the OAuth2 CSRF state (session_params) is deleted via a rebind inside a with chain, but Elixir's else-block scoping causes every f...

EEF-CVE-2026-81637 Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

Summary Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...

CVE-2026-81637 Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...

CVE-2026-82685 Confirmation token accepted on any record in AshAuthentication

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record...

EUVD-2026-81479

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record...

CVE-2026-82685

AshAuthentication (ash_authentication library by team-alembic) suffers from an Authorization Bypass Through User-Controlled Key in AddOn.Confirmation.ConfirmChange. The function verifies the token's signature and act claim but never compares the sub claim against changeset.data, so a confirmation...

CVE-2026-82685 Confirmation token accepted on any record in AshAuthentication

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record...

EEF-CVE-2026-82685 Confirmation token accepted on any record in AshAuthentication

Summary Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's...

CVE-2026-82685 Confirmation token accepted on any record in AshAuthentication

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record...

CVE-2026-92913

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode in objects/functions.php derives the code entirely from uniqid sprintf'%08x%05x', seconds, microseconds...

CVE-2026-92915

WWBN AVideo through commit e01e41ecc no patched version available contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement $global'ignoreUserMustBeLoggedIn' = 1, takes usersid directly from the query string, and calls User::sendVerificationLi...