Jonatan Männchen / EEF

safeurl validated address is not bound to the request, allowing DNS rebinding

Session id is not renewed on authentication in ash_authentication, allowing session fixation

Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

Sign-in token minted for one resource accepted by another in AshAuthentication

Token revocation record built from unverified JWT claims in AshAuthentication

Log injection via an unescaped password reset identity in AshAuthentication

Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication