Read the docs

pow-auth

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

pow-auth records in CISA KEV

No pow-auth vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Pow 2 records LOW Powassent 1 record LOW

Records

4 records

TI-2026-83456 CVE-2026-117656

Assent Apple callback lets unverified user parameter override ID token claims

Priority MEDIUM 47

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter o…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00228 Published 2026-10-30 Fixed in 0.3.2 CWE-290
TI-2019-12545 CVE-2019-16764 · GHSA-5653-437f-5hmc

PowAssent is susceptible to denial of service attacks

Priority LOW 31

The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01082 Published 2019-11-25 Fixed in 0.4.4 CWE-400
TI-2020-04261 CVE-2020-5205 · GHSA-v2wf-c3j6-wpvw

Session fixation attack in Pow (Hex package)

Priority LOW 30

In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0077 Published 2020-01-09 Fixed in 1.0.16 CWE-384
Open these records in search →