CVE-2026-78223

AshAuthentication (team-alembic, Elixir) suffers from an improper cryptographic signature verification in its token revocation flow. The function RevokeTokenChange.change/3 decodes the incoming token via Joken.peek_claims/1 without verifying its signature, then writes the jti, exp, and sub claims...

scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token

Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication...

GHSA-H6MP-MC7G-MG49 scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token

Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication...