Ash Authentication

Team-alembic Ash Authentication: Insufficient Session Expiration

also in 1 other product

Team-alembic Ash Authentication: Authentication Bypass by Spoofing

Team-alembic Ash Authentication: Authentication Bypass by Primary Weakness

OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

Team-alembic Ash Authentication: Authentication Bypass by Spoofing

Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in

Magic link single-use tokens replayable via TOCTOU race in AshAuthentication

Session id is not renewed on authentication in ash_authentication, allowing session fixation

Confirmation token accepted on any record in AshAuthentication

Sign-in token minted for one resource accepted by another in AshAuthentication

OAuth2/OIDC account takeover in AshAuthentication via email-based user matching

Log injection via an unescaped password reset identity in AshAuthentication

Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

Token revocation record built from unverified JWT claims in AshAuthentication

Team-alembic Ash Authentication: Authorization Bypass Through User-Controlled Key

Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

also in 1 other product

Team-alembic Ash Authentication: security vulnerability

Team-alembic Ash Authentication: Improper Restriction of Excessive Authentication Attempts

Reflected XSS in AshAuthentication confirmation and magic link interaction forms

Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

Team-alembic Ash Authentication: Improper Privilege Management

Ash Authentication email link auto-click account confirmation vulnerability

Actor record with password digest stored in AshAuthentication audit log entries

Reversible IP address pseudonymisation in AshAuthentication audit log hash mode