MAL-2025-14894 Malicious code in ash-5grfr-jsbt8-crystal-project (npm)

The package ash-5grfr-jsbt8-crystal-project was found to contain malicious code...

MAL-2025-14898 Malicious code in ash-drag-drop (npm)

The package ash-drag-drop was found to contain malicious code...

MAL-2025-14895 Malicious code in ash-5n1ax-68m0q-cascade-project (npm)

The package ash-5n1ax-68m0q-cascade-project was found to contain malicious code...

MAL-2025-26683 Malicious code in moondust-pyxu5-vbgaq-ash-project (npm)

The package moondust-pyxu5-vbgaq-ash-project was found to contain malicious code...

MAL-2025-14901 Malicious code in ash-q3gt7-hrboq-whisper-project (npm)

The package ash-q3gt7-hrboq-whisper-project was found to contain malicious code...

MAL-2025-14900 Malicious code in ash-profile (npm)

The package ash-profile was found to contain malicious code...

MAL-2025-14896 Malicious code in ash-bmadi-535bf-fjord-project (npm)

The package ash-bmadi-535bf-fjord-project was found to contain malicious code...

CVE-2025-4754

Insufficient Session Expiration vulnerability in ash-project ashauthenticationphoenix allows Session Hijacking. This vulnerability is associated with program files lib/ashauthenticationphoenix/controller.ex. This issue affects ashauthenticationphoenix until 2.10.0...

CVE-2025-4754 Missing Session Revocation on Logout in ash_authentication_phoenix

Insufficient Session Expiration vulnerability in team-alembic ashauthenticationphoenix allows a session token captured before sign-out to remain usable afterwards. The default signout/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls...

CVE-2025-4754 Missing Session Revocation on Logout in ash_authentication_phoenix

Insufficient Session Expiration vulnerability in team-alembic ashauthenticationphoenix allows a session token captured before sign-out to remain usable afterwards. The default signout/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls...

CVE-2025-4754

CVE-2025-4754 describes an Insufficient Session Expiration vulnerability in ash_authentication_phoenix (ash-project) that enables session hijacking. Affected component: lib/ash_authentication_phoenix/controller.ex; affected until version 2.10.0. Reported impact includes tokens remaining valid aft...

EEF-CVE-2025-4754 Missing Session Revocation on Logout in ash_authentication_phoenix

Summary Insufficient Session Expiration vulnerability in team-alembic ashauthenticationphoenix allows a session token captured before sign-out to remain usable afterwards. The default signout/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls...

PT-2025-25659

Name of the Vulnerable Software and Affected Versions ash-project ash authentication phoenix versions prior to 2.10.0 Description The issue affects the ash authentication phoenix library, where session tokens remain valid on the server after a user logs out. This creates a security gap where...

Ash Authentication Phoenix 代码问题漏洞

Ash Authentication Phoenix is an Alembic open source that provides plug-in authentication support for Phoenix applications using AshAuthentication. A security vulnerability exists in Ash Authentication Phoenix version 2.10.0 and earlier that stems from insufficient session expiration and could le...

CVE-2019-1020016

ASH-AIO before 2.0.0.3 allows an open redirect...

CVE-2025-32782

Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request triggered by clicking a link sent via email. Some email clients and security tools e.g., Outlook, virus scanners, and email previewers may automatically follow...

CVE-2025-32782

Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request triggered by clicking a link sent via email. Some email clients and security tools e.g., Outlook, virus scanners, and email previewers may automatically follow...

CVE-2025-32782 Ash Authentication email link auto-click account confirmation vulnerability

Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request triggered by clicking a link sent via email. Some email clients and security tools e.g., Outlook, virus scanners, and email previewers may automatically follow...

CVE-2025-32782 Ash Authentication email link auto-click account confirmation vulnerability

Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request triggered by clicking a link sent via email. Some email clients and security tools e.g., Outlook, virus scanners, and email previewers may automatically follow...

CVE-2025-32782 Ash Authentication email link auto-click account confirmation vulnerability

Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request triggered by clicking a link sent via email. Some email clients and security tools e.g., Outlook, virus scanners, and email previewers may automatically follow...