CVE-2026-85500

This is an authentication bypass in AshAuthentication (team-alembic, Elixir), rated CVSS 9.1 CRITICAL . The require_confirmed_with check in check_user/2 uses is_nil(Map.get(user, value)); when the attribute is not selected or hidden by a field policy, Map.get/2 returns %Ash.NotLoaded{} or %Ash.Fo...

CVE-2026-86533

CVE-2026-86533 is an Insufficient Session Expiration vulnerability in AshAuthentication and AshAuthentication Phoenix by team-alembic. When a resource uses session_identifier :jti with require_token_presence_for_authentication? disabled, the session value is stored as :. The jti exists to enable ...

CVE-2026-81632

AshAuthenticationPhoenix (team-alembic), an Elixir authentication library for Phoenix, places a single-use sign-in token as a query parameter in a GET redirect after successful password authentication. The token travels in the request line, where it is retained by access logs, reverse proxies, an...

CVE-2026-80218

AshAuthentication (by team-alembic ) is vulnerable to Improper Authentication : a sign-in token issued for one resource can be accepted by another. The root cause is that extract_primary_keys_from_subject/2 parses the JWT sub claim with URI.parse/1 and retains only the query string, discarding th...

CVE-2026-78223

AshAuthentication (team-alembic, Elixir) suffers from an improper cryptographic signature verification in its token revocation flow. The function RevokeTokenChange.change/3 decodes the incoming token via Joken.peek_claims/1 without verifying its signature, then writes the jti, exp, and sub claims...

CVE-2026-86522

AshAuthentication (team-alembic, Elixir/Phoenix) contains a log injection flaw in AshAuthentication.Strategy.Password.RequestPasswordReset.run/3. The identity argument—supplied directly from the password-reset request—is interpolated into Logger.warning/1 heredocs without escaping, truncating, or...

CVE-2026-81637

CVE-2026-81637 is an insufficient session expiration flaw in AshAuthentication (team-alembic, Elixir ecosystem). In AshAuthentication.Strategy.OAuth2.Plug.callback/2, the OAuth2 CSRF state (session_params) is deleted via a rebind inside a with chain, but Elixir's else-block scoping causes every f...

CVE-2026-82761

AshAuthentication (by team-alembic) is vulnerable to a TOCTOU race condition that allows concurrent redemptions of a single-use magic link token. The sign-in flow verifies the JWT via Jwt.verify/4 and revokes it only in an after_action or after_transaction hook, after the sign-in has already comm...

CVE-2026-82685

AshAuthentication (ash_authentication library by team-alembic) suffers from an Authorization Bypass Through User-Controlled Key in AddOn.Confirmation.ConfirmChange. The function verifies the token's signature and act claim but never compares the sub claim against changeset.data, so a confirmation...

CVE-2026-82760

AshAuthentication (Elixir library by team-alembic) is vulnerable to CPU and memory exhaustion via superlinear base62 decoding in the API key sign-in flow. The root cause is in AshAuthentication.Base.decode62/1, which recomputes Integer.pow(62, index) at every character position instead of accumul...

CVE-2026-82759

AshAuthentication (team-alembic), an Elixir authentication library, contains a vulnerability in its audit log IP privacy mode. The function IpPrivacy.hash_ip/1 computes an unkeyed SHA-256 hash using a salt that falls back to the publicly known constant "default-salt-change-in-production". Because...

CVE-2026-82723

AshAuthentication (the Elixir authentication library by team-alembic) stores full actor records—including the hashed_password attribute—into audit log entries via the audit_log add-on's build_extra_data/4 function. The :actor value from the action callback context is deposited verbatim, bypassing...

CVE-2026-92904

CVE-2026-92904 is a flaw in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves a job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job...

CVE-2026-92932

CVE-2026-92932 affects the MISP sachertortephp library, specifically the Xml::build() static method in lib/Cake/Utility/Xml.php. The root cause is a PHP operator precedence error : the condition $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0 evaluates ...

CVE-2026-92921

admin3 (versions through 3.0.0 ) stores account passwords using single-round MD5 with only the username as salt and no key derivation function, as seen in its SecurityUtil.java and UserCredential.java source files. Because MD5 is computationally inexpensive, an attacker with database access can r...

CVE-2026-92920

admin3 (a Java-based admin framework) through 3.0.0 fails to invalidate existing sessions when a user account is disabled. The root cause lies in the AuthInterceptor , which never re-validates a user's locked status, and the LocalSessionManager , which resets session expiry on each request. As a ...

CVE-2026-92918

admin3 through 3.0.0 discloses user session tokens in the audit log event body when publishing UserLoggedIn domain events. The root cause is that DefaultSessionService persists the session token into the log entry, making it retrievable via the GET /logs endpoint by any user with log:view permiss...

CVE-2026-92919

admin3 versions through 3.0.0 are affected by an arbitrary file write vulnerability in the storage upload handler . The application fails to sanitize client-supplied filenames, allowing authenticated (low-privilege) users to inject dot-dot path traversal segments that escape the configured storag...

CVE-2026-81481

Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain a Path Traversal vulnerability (improper limitation of a pathname to a restricted directory). An unauthenticated attacker with remote access could exploit this to gain filesystem access , with a HIGH confidentiality impact bu...

CVE-2026-81480

Dell OpenManage Server Administrator (OMSA) , versions prior to 11.1.0.3 , contains a Stack-based Buffer Overflow vulnerability. A high-privileged attacker with remote network access can potentially exploit it to achieve code execution , resulting in high impact to confidentiality, integrity, and...