How many CVEs have a located fix in team-alembic/ash_authentication?

20 published CVEs have a fix traced to functions in team-alembic/ash_authentication, touching 247 functions across 188 files.

Which function in team-alembic/ash_authentication has been patched by the most CVEs?

Otherwise in lib/ash_authentication/strategies/oauth2/user_resolver.ex has been changed by 3 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in team-alembic/ash_authentication?

The median fix changes 1,005 lines. 5% of fixes change 20 lines or fewer, and 5% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

elixir

#267 of 500 repositories

team-alembic/ash_authentication

Name: team-alembic/ash_authentication: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 17, 2026

20

CVE fixes located

Published CVEs

247

Functions patched

Distinct function sites

188

Files patched

Distinct source files

2025–2026

Years covered

By CVE publication date

Overview

20 published CVEs have a fix traced to functions in team-alembic/ash_authentication, the earliest published in 2025. Those fixes changed 247 distinct functions across 188 files, in 1,715 patch hunks.

Among the 500 repositories tracked here, team-alembic/ash_authentication ranks #267 by the number of CVEs with a located fix.

Most patched functions

Functions in team-alembic/ash_authentication changed by the most CVE fixes.

Most patched files

Files in team-alembic/ash_authentication changed by the most CVE fixes.

1.formatter.exs10 CVEs · 0 functions
2mix.exs8 CVEs · 3 functions
3lib/ash_authentication.ex7 CVEs · 3 functions
4lib/ash_authentication/plug/helpers.ex6 CVEs · 11 functions
5lib/ash_authentication/validations.ex6 CVEs · 5 functions
6lib/mix/tasks/ash_authentication.add_strategy.ex5 CVEs · 5 functions
7lib/ash_authentication/jwt.ex5 CVEs · 4 functions
8lib/ash_authentication/strategies/oauth2/actions.ex5 CVEs · 4 functions
9lib/ash_authentication/strategies/oauth2/sign_in_preparation.ex5 CVEs · 4 functions
10lib/ash_authentication/strategies/password/transformer.ex5 CVEs · 1 functions

Fix size

How much code a CVE fix in team-alembic/ash_authentication changes, with backports counted once.

1,005

Median lines changed

Added plus removed, per CVE

5%

Fixes of 20 lines or fewer

Share of CVE fixes

5%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in team-alembic/ash_authentication, and the functions each fix changed.

Session id is not renewed on authentication in ash_authentication, allowing session fixation
CVE-2026-86688store_in_session
High · CVSS 7.4
EPSS 0.7%2026-09-17
Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement
CVE-2026-76949prepare up transform
Critical · CVSS 9.1
EPSS 0.8%2026-09-17
dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover
CVE-2026-91039Otherwise do_change action_context
Critical · CVSS 9.1
EPSS 0.7%2026-09-17
OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication
CVE-2026-88952Otherwise do_change up
Critical · CVSS 9.1
EPSS 0.7%2026-09-17
`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
CVE-2026-85500asks user_confirmed verify_result
Critical · CVSS 9.1
EPSS 0.8%2026-09-17
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
CVE-2026-86533revoke_session_tokens validate_revoke_jti_action validate_session_jti
Critical · CVSS 9.1
EPSS 0.9%2026-09-17
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
CVE-2026-81632prepare build_sign_in_with_token_action verify
High · CVSS 7.2
EPSS 0.2%2026-09-17
Sign-in token minted for one resource accepted by another in AshAuthentication
CVE-2026-80218prepare extract_primary_keys_from_subject subject_to_primary_key
High · CVSS 7.6
EPSS 0.6%2026-09-17
Token revocation record built from unverified JWT claims in AshAuthentication
CVE-2026-78223run revoke_remember_me_token peek_jti
Medium · CVSS 6.9
EPSS 0.4%2026-09-17
Log injection via an unescaped password reset identity in AshAuthentication
CVE-2026-86522map_join add_new_strategy run
Medium · CVSS 6.3
EPSS 0.7%2026-09-17
Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication
CVE-2026-81637after transform callback
Low · CVSS 2.3
EPSS 0.6%2026-09-17
Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
CVE-2026-82761up field transform
Critical · CVSS 9.1
EPSS 0.6%2026-09-17

Get an alert for each new team-alembic/ash_authentication CVE, with the patched functions and AI-written analysis.

Monitor ash_authentication CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

DCMTK/dcmtk20 CVEs git/git20 CVEs hestiacp/hestiacp20 CVEs jgraph/drawio20 CVEs langgenius/dify20 CVEs michaelrsweet/htmldoc20 CVEs misskey-dev/misskey20 CVEs nats-io/nats-server20 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in team-alembic/ash_authentication.

How many CVEs have a located fix in team-alembic/ash_authentication?: 20 published CVEs have a fix traced to functions in team-alembic/ash_authentication, touching 247 functions across 188 files.
Which function in team-alembic/ash_authentication has been patched by the most CVEs?: Otherwise in lib/ash_authentication/strategies/oauth2/user_resolver.ex has been changed by 3 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in team-alembic/ash_authentication?: The median fix changes 1,005 lines. 5% of fixes change 20 lines or fewer, and 5% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track team-alembic/ash_authentication CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing