Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: team-alembic ash_authentication 4.14.2, 5.0.0-rc.13 Clear all filters
TI-2026-46782 CVE-2026-65633

Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

Priority HIGH 68

Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resource uses stateless bearer-token verification.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00582 Published 2026-08-25 Fixed in 4.14.2, 5.0.0-rc.13 CWE-287
TI-2026-47468 CVE-2026-66882

Reflected XSS in AshAuthentication confirmation and magic link interaction forms

Priority MEDIUM 44

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.0075 Published 2026-08-25 Fixed in 4.14.2, 5.0.0-rc.13 CWE-79