ash_authentication (Hex)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 5.0.0-rc.14 or later clears every advisory below that has a fix.

Upgrade commands

mix

{:ash_authentication, "~> 5.0.0-rc.14"} # then: mix deps.update ash_authentication

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
EEF-CVE-2026-86688 Session id is not renewed on authentication in ash_authentication, allowing session fixation	Not rated yet EPSS 0.74%	`>= 0.2.0, < 4.15.0` `>= 5.0.0-rc.0, < 5.0.0-rc.14`	`4.15.0` `5.0.0-rc.14`
EEF-CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement	Not rated yet EPSS 0.77%	`>= 4.10.0, < 4.15.0` `>= 5.0.0-rc.0, < 5.0.0-rc.14`	`4.15.0` `5.0.0-rc.14`
EEF-CVE-2026-91039 dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover	Not rated yet EPSS 0.66%	`>= 5.0.0-rc.10, < 5.0.0-rc.14`	`5.0.0-rc.14`
EEF-CVE-2026-88952 OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication	Not rated yet EPSS 0.75%	`>= 4.14.0, < 4.15.0` `>= 5.0.0-rc.10, < 5.0.0-rc.14`	`4.15.0` `5.0.0-rc.14`
EEF-CVE-2026-85500 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication	Not rated yet EPSS 0.77%	`>= 4.3.8, < 4.15.0` `>= 5.0.0-rc.0, < 5.0.0-rc.14`	`4.15.0` `5.0.0-rc.14`
EEF-CVE-2026-86533 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix	Not rated yet EPSS 0.91%	`>= 4.9.1, < 4.15.0` `>= 5.0.0-rc.0, < 5.0.0-rc.14`	`4.15.0` `5.0.0-rc.14`
EEF-CVE-2026-81632 Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix	Not rated yet EPSS 0.21%	`>= 3.10.5, < 4.15.0` `>= 5.0.0-rc.0, < 5.0.0-rc.14`	`4.15.0` `5.0.0-rc.14`
EEF-CVE-2026-80218 Sign-in token minted for one resource accepted by another in AshAuthentication	Not rated yet EPSS 0.64%	`>= 3.10.5, < 4.15.0` `>= 5.0.0-rc.0, < 5.0.0-rc.14`	`4.15.0` `5.0.0-rc.14`
EEF-CVE-2026-78223 Token revocation record built from unverified JWT claims in AshAuthentication	Not rated yet EPSS 0.44%	`>= 0.2.0, < 4.15.0` `>= 5.0.0-rc.0, < 5.0.0-rc.14`	`4.15.0` `5.0.0-rc.14`
EEF-CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication	Not rated yet EPSS 0.74%	`>= 4.2.0, < 4.15.0` `>= 5.0.0-rc.0, < 5.0.0-rc.14`	`4.15.0` `5.0.0-rc.14`
EEF-CVE-2026-81637 Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication	Not rated yet EPSS 0.61%	`>= 0.6.0, < 4.15.0` `>= 5.0.0-rc.0, < 5.0.0-rc.14`	`4.15.0` `5.0.0-rc.14`
EEF-CVE-2026-82761 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication	Not rated yet EPSS 0.56%	`>= 3.9.0, < 4.15.0` `>= 5.0.0-rc.0, < 5.0.0-rc.14`	`4.15.0` `5.0.0-rc.14`
EEF-CVE-2026-82685 Confirmation token accepted on any record in AshAuthentication	Not rated yet EPSS 0.66%	`>= 0.5.0, < 4.15.0` `>= 5.0.0-rc.0, < 5.0.0-rc.14`	`4.15.0` `5.0.0-rc.14`
EEF-CVE-2026-82760 Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in	Not rated yet EPSS 0.74%	`>= 4.8.0, < 4.15.0` `>= 5.0.0-rc.0, < 5.0.0-rc.14`	`4.15.0` `5.0.0-rc.14`
EEF-CVE-2026-82759 Reversible IP address pseudonymisation in AshAuthentication audit log hash mode	Not rated yet EPSS 0.14%	`>= 4.12.0, < 4.15.0` `>= 5.0.0-rc.0, < 5.0.0-rc.14`	`4.15.0` `5.0.0-rc.14`
EEF-CVE-2026-82723 Actor record with password digest stored in AshAuthentication audit log entries	Not rated yet EPSS 0.18%	`>= 4.12.0, < 4.15.0` `>= 5.0.0-rc.0, < 5.0.0-rc.2`	`4.15.0` `5.0.0-rc.2`
EEF-CVE-2026-65633 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication	Not rated yet EPSS 0.58%	`>= 3.10.5, < 4.14.2` `>= 5.0.0-rc.0, < 5.0.0-rc.13`	`4.14.2` `5.0.0-rc.13`
EEF-CVE-2026-66882 Reflected XSS in AshAuthentication confirmation and magic link interaction forms	Not rated yet EPSS 0.75%	`>= 4.8.0, < 4.14.2` `>= 5.0.0-rc.0, < 5.0.0-rc.13`	`4.14.2` `5.0.0-rc.13`
EEF-CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching	Critical EPSS 0.61%	`>= 0.1.0, < 4.14.0` `>= 5.0.0-rc.0, < 5.0.0-rc.10`	`4.14.0` `5.0.0-rc.10`
EEF-CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching	Critical EPSS 0.61%	`>= 0.1.0, < 4.14.0`	`4.14.0`
EEF-CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching	Critical EPSS 0.61%	`>= 5.0.0-rc.0, < 5.0.0-rc.10`	`5.0.0-rc.10`
GHSA-3988-q8q7-p787 ash_authentication has email link auto-click account confirmation vulnerability	Medium EPSS 0.32%	`< 4.7.0`	`4.7.0`
GHSA-qrm9-f75w-hg4c Ash Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install`	Medium EPSS 0.31%	`>= 4.1.0, < 4.4.9`	`4.4.9`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor