Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: team-alembic ash_authentication 5.0.0-rc.16 Clear all filters
TI-2026-84394 CVE-2026-118505

Missing sign-in attempt limit in AshAuthentication custom actions

Priority LOW 29

Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00576 Published 2026-11-03 Fixed in 5.0.0-rc.16 CWE-307
TI-2026-84395 CVE-2026-119215

TOTP setup in AshAuthentication lets users take over others' accounts

Priority LOW 36

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that us…

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00505 Published 2026-11-03 Fixed in 5.0.0-rc.16 CWE-639