CVE-2026-80218 Sign-in token minted for one resource accepted by another in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extractprimarykeysfromsubject/2 parse...

CVE-2026-80218 Sign-in token minted for one resource accepted by another in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extractprimarykeysfromsubject/2 parse...

EUVD-2026-81484

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extractprimarykeysfromsubject/2 parse...

PT-2026-95161

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.10.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description An authentication bypass by spoofing allows an attacker to replace a victim's authenticated session with their own account...

PT-2026-94289

Name of the Vulnerable Software and Affected Versions ash authentication versions 3.10.5 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description Improper authentication allows an attacker with a sign-in token for one authenticated resource to be signed in as a user o...

PT-2026-94292

Name of the Vulnerable Software and Affected Versions ash authentication phoenix versions 1.7.0 through 2.17.3 ash authentication phoenix versions 3.0.0-rc.0 through 3.0.0-rc.10 ash authentication versions 3.10.5 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Descriptio...

Boost Engagement with Free Passkeys by Wordfence

Imagine you can sign in with one click. Now imagine all the users on your WooCommerce store or WordPress powered website can sign in with one click. Firstly it makes your life a lot easier. But more importantly, you’ve removed friction from users logging in to make purchases, to engage in your...

CVE-2026-20683

An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account...

EUVD-2026-78039

An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account...

CVE-2026-20683

An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account...

Astra Linux – Vulnerability in Chromium

Chromium: CVE-2021-30609 – Use after free in Sign-In...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Sign-In process in Google Chrome prior to version 1.3.36.351 allowed a remote attacker to bypass navigation restrictions through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The use of “after free” in the Sign-In process in Google Chrome before version 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption through profile destruction. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Before version 97.0.4692.71, using "Use after free" in the "Sign-in" process in Google Chrome allowed a remote attacker to convince a user to perform certain user gestures, thereby potentially exploiting heap corruption through those gestures...

Astra Linux – Vulnerability in Chromium

Before version 105.0.5195.52, using “after free” in the Sign-In Flow in Google Chrome allowed a remote attacker who convinced a user to engage in certain UI interactions to potentially exploit heap corruption through crafted UI interactions...

Astra Linux – Vulnerability in Chromium

In the Sign-In Flow in Google Chrome, using after free before version 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

CVE-2026-20683: Improper Authentication

An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account...

CVE-2026-86117

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any...

SUSE CVE-2026-55502

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...

CVE-2026-85022

A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/shareLayout/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirecturl leads to cross...