Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: pow-auth Clear all filters
TI-2026-83456 CVE-2026-117656

Assent Apple callback lets unverified user parameter override ID token claims

Priority MEDIUM 47

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter o…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00228 Published 2026-10-30 Fixed in 0.3.2 CWE-290
TI-2020-04261 CVE-2020-5205 · GHSA-v2wf-c3j6-wpvw

Session fixation attack in Pow (Hex package)

Priority LOW 30

In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0077 Published 2020-01-09 Fixed in 1.0.16 CWE-384
TI-2019-12545 CVE-2019-16764 · GHSA-5653-437f-5hmc

PowAssent is susceptible to denial of service attacks

Priority LOW 31

The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01082 Published 2019-11-25 Fixed in 0.4.4 CWE-400