CVE-2026-86688

CVE-2026-86688 is a session fixation vulnerability in ash_authentication , an Elixir authentication library by team-alembic. The root cause is that AshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session via Plug.Conn.put_session/3 without ever...

CVE-2026-76949

CVE-2026-76949 is an Authentication Bypass by Spoofing flaw in the Elixir library ash_authentication (by team-alembic). The root cause is a session-key mismatch: sign_in_using_remember_me/3 checks for "_token", but store_in_session/2 only writes that key when require_token_presence_for_authentica...

CVE-2026-91039

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in...

EUVD-2026-81687

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in...

CVE-2026-91039

team-alembic/ash_authentication versions 5.0.0-rc.10 through before 5.0.0-rc.14 are affected by an Authentication Bypass by Spoofing in the dynamic_oidc strategy. The __connection_id__ field is populated only on an ephemeral per-request struct, but DynamicOidc.IdentityChange.change/3 re-fetches t...

CVE-2026-91039 dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in...

CVE-2026-80218

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extractprimarykeysfromsubject/2 parse...

EUVD-2026-81619

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action...

EUVD-2026-81480

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be...

EUVD-2026-81478

Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key. AshAuthentication.Base.decode62/1 in lib/ashauthentication/base.ex splits its argument into one...