ash_authentication_phoenix (Hex)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 3.0.0-rc.11 or later clears every advisory below that has a fix.

Upgrade commands

mix

{:ash_authentication_phoenix, "~> 3.0.0-rc.11"} # then: mix deps.update ash_authentication_phoenix

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
EEF-CVE-2026-86533 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix	Not rated yet EPSS 0.91%	`>= 2.10.0, < 2.17.4` `>= 3.0.0-rc.0, < 3.0.0-rc.11`	`2.17.4` `3.0.0-rc.11`
EEF-CVE-2026-81632 Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix	Not rated yet EPSS 0.21%	`>= 1.7.0, < 2.17.4` `>= 3.0.0-rc.0, < 3.0.0-rc.11`	`2.17.4` `3.0.0-rc.11`
EEF-CVE-2025-4754 Missing Session Revocation on Logout in ash_authentication_phoenix	Low EPSS 0.50%	`>= 0.1.0, < 2.10.0`	`2.10.0`
EEF-CVE-2025-4754 Missing Session Revocation on Logout in ash_authentication_phoenix	Low EPSS 0.50%	`< 2.10.0`	`2.10.0`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor