Jonatan Männchen / EEF

Magic link single-use tokens replayable via TOCTOU race in AshAuthentication

Confirmation token accepted on any record in AshAuthentication

Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in

Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication

Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1

Path Traversal in Local File Store Backend

mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches

mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot