CVE-2026-65633

Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resource uses stateless bearer-token verification. The bearer-token authentication helper AshAuthentication.Plug.Helpers.retrievefrombearer/3...

CVE-2026-65633

AshAuthentication (team-alembic) contains an improper authentication flaw where the stateless bearer-token helper retrieve_from_bearer/3 fails to verify that a JWT's purpose claim equals user. When a resource uses the default require_token_presence_for_authentication?: false, purpose-limited toke...

EUVD-2026-65322

Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resource uses stateless bearer-token verification. The bearer-token authentication helper AshAuthentication.Plug.Helpers.retrievefrombearer/3...

CVE-2026-65633 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resource uses stateless bearer-token verification. The bearer-token authentication helper AshAuthentication.Plug.Helpers.retrievefrombearer/3...

CVE-2026-65633 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resource uses stateless bearer-token verification. The bearer-token authentication helper AshAuthentication.Plug.Helpers.retrievefrombearer/3...

PT-2026-81202

Name of the Vulnerable Software and Affected Versions ash authentication versions 3.10.5 through 4.14.1 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.12 Description Improper authentication allows purpose-limited JSON Web Tokens JWTs to be replayed as full bearer API credentials when a...