ash_authentication_phoenix
Drop-in authentication support for Phoenix apps using AshAuthentication.
View on Github
Activity
- Latest release
- 1mo ago
- Total releases
- 115
- Cadence
- ~7 days
- Last 12 months
- 23
Reach
- Downloads
- 781.6k
- Stars
- 83
Details
- License
- MIT
- First release
- Dec 08, 2022
| Version | Released | |
|---|---|---|
3.0.0-rc.11
pre
|
3.0.0-rc.11
pre
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
2.17.4
patch
|
2.17.4
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.17.3
patch
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.17.3
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
3.0.0-rc.10
pre
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
3.0.0-rc.10
pre
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
3.0.0-rc.9
pre
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
3.0.0-rc.9
pre
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
2.17.2
patch
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.17.2
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
3.0.0-rc.8
pre
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
3.0.0-rc.8
pre
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
2.17.1
patch
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.17.1
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
3.0.0-rc.7
pre
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
3.0.0-rc.7
pre
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
2.17.0
minor
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.17.0
minor
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
3.0.0-rc.6
pre
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
3.0.0-rc.6
pre
Dependencies (17)
+ 9 more
Changelog
Compare changes
|
|
3.0.0-rc.4
pre
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
3.0.0-rc.4
pre
Dependencies (14)
+ 6 more
Changelog
Compare changes
|
|
3.0.0-rc.3
pre
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
3.0.0-rc.3
pre
Dependencies (14)
+ 6 more
Changelog
Compare changes
|
|
3.0.0-rc.2
pre
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
3.0.0-rc.2
pre
Dependencies (14)
+ 6 more
Changelog
Compare changes
|
|
3.0.0-rc.1
pre
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
3.0.0-rc.1
pre
Dependencies (14)
+ 6 more
Changelog
Compare changes
|
|
2.16.0
minor
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.16.0
minor
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
3.0.0-rc.0
pre
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
3.0.0-rc.0
pre
Dependencies (14)
+ 6 more
Changelog
Compare changes
|
|
2.15.0
minor
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.15.0
minor
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.14.1
patch
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.14.1
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.14.0
minor
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.14.0
minor
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.13.1
patch
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.13.1
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.13.0
minor
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.13.0
minor
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.12.2
patch
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.12.2
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.12.1
patch
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.12.1
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.12.0
minor
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.12.0
minor
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.11.0
minor
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.11.0
minor
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.10.5
patch
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.10.5
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.10.4
patch
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.10.4
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.10.3
patch
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.10.3
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.10.2
patch
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.10.2
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.10.1
patch
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.10.1
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.10.0
minor
2 CVEs
CVE-2026-86533
EEF-CVE-2026-86533
GHSA-m6x4-4gvp-xwjr
Sep 17, 2026
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Critical
Network
Low
None
None
SummaryInsufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11. Affected versions
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
+ 18 more Show less
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Oct 13, 2026 · Source: OSV.dev
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev |
2.10.0
minor
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.9.0
minor
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.9.0
minor
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.8.0
minor
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.8.0
minor
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.7.0
minor
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.7.0
minor
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.6.3
patch
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.6.3
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.6.2
patch
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.6.2
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.6.1
patch
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.6.1
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.6.0
minor
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.6.0
minor
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.5.4
patch
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.5.4
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.5.3
patch
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.5.3
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.5.2
patch
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.5.2
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.5.1
patch
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.5.1
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.5.0
minor
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.5.0
minor
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.4.8
patch
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.4.8
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.4.7
patch
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.4.7
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.4.6
patch
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.4.6
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.4.5
patch
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.4.5
patch
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
2.4.4
patch
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.4.4
patch
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
2.4.3
patch
2 CVEs
CVE-2026-81632
EEF-CVE-2026-81632
GHSA-8jh5-339h-mqx9
Sep 17, 2026
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Critical
Local
Low
Low
None
SummaryUse of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in, This issue affects ash_authentication_phoenix: from 1.7.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11; ash_authentication: from 3.10.5 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. Affected versions
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
+ 77 more Show less
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.17.1
2.17.2
2.17.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
3.0.0-rc.0
3.0.0-rc.1
3.0.0-rc.10
3.0.0-rc.2
3.0.0-rc.3
3.0.0-rc.4
3.0.0-rc.6
3.0.0-rc.7
3.0.0-rc.8
3.0.0-rc.9
Fixed in
2.17.4
3.0.0-rc.11
References
Updated Sep 17, 2026 · Source: OSV.dev
CVE-2025-4754
EEF-CVE-2025-4754
GHSA-f7gq-h8jv-h3cq
Jun 17, 2025
Missing Session Revocation on Logout in ash_authentication_phoenix
Medium
Network
Low
None
SummaryInsufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default This issue affects ash_authentication_phoenix: from 0.1.0 before 2.10.0. Affected versions
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
+ 71 more Show less
1.4.6
1.4.7
1.4.8
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
2.0.0
2.0.0-rc.0
2.0.0-rc.1
2.0.0-rc.2
2.0.1
2.0.2
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.8.0
2.9.0
Fixed in
2.10.0
References
Updated Sep 22, 2026 · Source: OSV.dev |
2.4.3
patch
Dependencies (12)
+ 4 more
Changelog
Compare changes
|