James Harton

Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

Magic link single-use tokens replayable via TOCTOU race in AshAuthentication

Confirmation token accepted on any record in AshAuthentication

Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in

Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication

Reflected XSS in AshAuthentication confirmation and magic link interaction forms

Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

OAuth2/OIDC account takeover in AshAuthentication via email-based user matching