CVE-2026-76949

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

CVE-2026-53554

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/datasource/api/datasource.py uses attacker-controlled multipart filename data when selecting where uploaded content is stored, writes...

EUVD-2026-82578

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

CVE-2026-76949

CVE-2026-76949 is an Authentication Bypass by Spoofing flaw in the Elixir library ash_authentication (by team-alembic). The root cause is a session-key mismatch: sign_in_using_remember_me/3 checks for "_token", but store_in_session/2 only writes that key when require_token_presence_for_authentica...

EUVD-2026-82561

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/datasource/api/datasource.py uses attacker-controlled multipart filename data when selecting where uploaded content is stored, writes...

CVE-2026-53554 SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/datasource/api/datasource.py uses attacker-controlled multipart filename data when selecting where uploaded content is stored, writes...

CVE-2026-53554 SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/datasource/api/datasource.py uses attacker-controlled multipart filename data when selecting where uploaded content is stored, writes...

CVE-2026-53554

SQLBot (an intelligent Text-to-SQL system based on LLMs and RAG) is vulnerable to arbitrary file write leading to remote code execution prior to version 1.9.0 . The POST /api/v1/datasource/parseExcel endpoint uses attacker-controlled multipart filename data to determine the storage path, writes c...

EUVD-2026-81687

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in...

CVE-2026-88952

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action...

CVE-2026-82759

Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit log add-on's :hash privacy mode is meant to pseudonymise. AshAuthentication.AddOn.AuditLog.IpPrivacy.haship/1 computes ...

CVE-2026-81632

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...

CVE-2026-80218

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extractprimarykeysfromsubject/2 parse...

CVE-2026-88952 OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action...

EEF-CVE-2026-88952 OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

Summary Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the registe...

CVE-2026-85500 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication

Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.checkuser/2 decides whether the attribute named by...

EUVD-2026-81487

Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.checkuser/2 decides whether the attribute named by...

CVE-2026-80218 Sign-in token minted for one resource accepted by another in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extractprimarykeysfromsubject/2 parse...

CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...

CVE-2026-82761 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be...