Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-55735 (GCVE-0-2026-55735)

Vulnerability from nvd – Published: 2026-08-01 18:46 – Updated: 2026-08-03 19:30

Title

Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation

Summary

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 19:29 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

EEF

References

4 references

URL	Tags
https://github.com/ueberauth/guardian/security/ad…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-55735.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-55735	related
https://github.com/ueberauth/guardian/commit/2bd7…	patch

Impacted products

2 products

Vendor	Product	Version
ueberauth	guardian	Affected: 1.0.0 , < 2.4.1 (semver) cpe:2.3:a:ueberauth:guardian::::::::
ueberauth	guardian	Affected: d65227145f72b290106c06cecbe42728fbf05fe2 , < 2bd7a8c29770d423d855c0a4965caa6c3e486901 (git) cpe:2.3:a:ueberauth:guardian::::::::

Credits

Peter Ullrich Yordis Prieto Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55735",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T19:29:43.841542Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T19:30:07.608Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-7975-hp3r-5qhv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian\u0027"
          ],
          "packageName": "guardian",
          "packageURL": "pkg:hex/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian\u0027:revoke/3"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "2.4.1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian\u0027"
          ],
          "packageName": "ueberauth/guardian",
          "packageURL": "pkg:github/ueberauth/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian\u0027:revoke/3"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "2bd7a8c29770d423d855c0a4965caa6c3e486901",
              "status": "affected",
              "version": "d65227145f72b290106c06cecbe42728fbf05fe2",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application must route a caller-supplied token into \u003ctt\u003eGuardian.revoke/3\u003c/tt\u003e (for example a logout or session-revocation endpoint) and use a token module whose \u003ctt\u003erevoke\u003c/tt\u003e / \u003ctt\u003eon_revoke\u003c/tt\u003e callback mutates state keyed by the token claims (a whitelist that deletes by \u003ctt\u003ejti\u003c/tt\u003e or a blacklist that inserts by \u003ctt\u003ejti\u003c/tt\u003e, such as a GuardianDb-style store). With the default no-op \u003ctt\u003eon_revoke\u003c/tt\u003e callback, no session state is changed and the issue is not exploitable.\u003c/p\u003e"
            }
          ],
          "value": "The application must route a caller-supplied token into Guardian.revoke/3 (for example a logout or session-revocation endpoint) and use a token module whose revoke / on_revoke callback mutates state keyed by the token claims (a whitelist that deletes by jti or a blacklist that inserts by jti, such as a GuardianDb-style store). With the default no-op on_revoke callback, no session state is changed and the issue is not exploitable."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.4.1",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Yordis Prieto"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim\u0027s session with a forged token.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eGuardian.revoke/3\u003c/tt\u003e in \u003ctt\u003elib/guardian.ex\u003c/tt\u003e decodes the supplied token with \u003ctt\u003epeek/1\u003c/tt\u003e, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module\u0027s \u003ctt\u003erevoke\u003c/tt\u003e callback and the implementation\u0027s \u003ctt\u003eon_revoke\u003c/tt\u003e callback, a state-mutating sink. The sibling operations \u003ctt\u003erefresh/2\u003c/tt\u003e and \u003ctt\u003eexchange/4\u003c/tt\u003e both call \u003ctt\u003edecode_and_verify\u003c/tt\u003e first, so the signature is checked before anything acts on the claims; \u003ctt\u003erevoke/3\u003c/tt\u003e is the only state-mutating path that acts on claims without verifying the signature.\u003c/p\u003e\u003cp\u003eAn attacker who knows or guesses a victim\u0027s identifying claim values (\u003ctt\u003ejti\u003c/tt\u003e, \u003ctt\u003esub\u003c/tt\u003e) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into \u003ctt\u003eGuardian.revoke/3\u003c/tt\u003e (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim\u0027s legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret.\u003c/p\u003e\u003cp\u003eThis issue affects guardian: from 1.0.0 before 2.4.1.\u003c/p\u003e"
            }
          ],
          "value": "Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim\u0027s session with a forged token.\n\nGuardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module\u0027s revoke callback and the implementation\u0027s on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature.\n\nAn attacker who knows or guesses a victim\u0027s identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim\u0027s legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret.\n\nThis issue affects guardian: from 1.0.0 before 2.4.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-475",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-475 Signature Spoofing by Improper Validation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T18:46:05.234Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-7975-hp3r-5qhv"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-55735.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-55735"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ueberauth/guardian/commit/2bd7a8c29770d423d855c0a4965caa6c3e486901"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eVerify the token before revoking it: call \u003ctt\u003edecode_and_verify\u003c/tt\u003e (or a verify-without-expiry variant, so already-expired tokens remain revocable) on the caller-supplied token and pass only tokens whose signature validates into \u003ctt\u003eGuardian.revoke/3\u003c/tt\u003e. Reject tokens with an invalid signature at the application boundary.\u003c/p\u003e"
            }
          ],
          "value": "Verify the token before revoking it: call decode_and_verify (or a verify-without-expiry variant, so already-expired tokens remain revocable) on the caller-supplied token and pass only tokens whose signature validates into Guardian.revoke/3. Reject tokens with an invalid signature at the application boundary."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-55735",
    "datePublished": "2026-08-01T18:46:05.234Z",
    "dateReserved": "2026-06-17T10:44:34.365Z",
    "dateUpdated": "2026-08-03T19:30:07.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55734 (GCVE-0-2026-55734)

Vulnerability from nvd – Published: 2026-08-01 18:46 – Updated: 2026-08-03 16:49

Title

guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1

Summary

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 16:49 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

EEF

References

4 references

URL	Tags
https://github.com/ueberauth/guardian/security/ad…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-55734.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-55734	related
https://github.com/ueberauth/guardian/commit/8d4e…	patch

Impacted products

2 products

Vendor	Product	Version
ueberauth	guardian	Affected: 2.0.0 , < 2.4.1 (semver) cpe:2.3:a:ueberauth:guardian::::::::
ueberauth	guardian	Affected: b7a6128ca4d0ffb7f7df5219dd982304ff9d6802 , < 8d4efbfc352d30f5fcfc75a4d69a795b0e472724 (git) cpe:2.3:a:ueberauth:guardian::::::::

Credits

Peter Ullrich Yordis Prieto Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55734",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T16:49:36.457207Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T16:49:59.913Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-9qx2-v587-q3gg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian.Permissions\u0027"
          ],
          "packageName": "guardian",
          "packageURL": "pkg:hex/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian/permissions.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian.Permissions\u0027:encode_permissions!/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Permissions\u0027:encode_permissions_into_claims!/2"
            },
            {
              "name": "\u0027Elixir.Guardian.Permissions\u0027:do_encode_permissions!/2"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "2.4.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian.Permissions\u0027"
          ],
          "packageName": "ueberauth/guardian",
          "packageURL": "pkg:github/ueberauth/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian/permissions.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian.Permissions\u0027:encode_permissions!/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Permissions\u0027:encode_permissions_into_claims!/2"
            },
            {
              "name": "\u0027Elixir.Guardian.Permissions\u0027:do_encode_permissions!/2"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "8d4efbfc352d30f5fcfc75a4d69a795b0e472724",
              "status": "affected",
              "version": "b7a6128ca4d0ffb7f7df5219dd982304ff9d6802",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThis vulnerability is only exploitable in applications that use \u003ctt\u003eGuardian.Permissions\u003c/tt\u003e (via \u003ctt\u003euse Guardian.Permissions\u003c/tt\u003e) and route attacker-influenced data into \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e or \u003ctt\u003eencode_permissions_into_claims!/2\u003c/tt\u003e, for example by reading a permissions map from a request body and passing it into token issuance.\u003c/p\u003e"
            }
          ],
          "value": "This vulnerability is only exploitable in applications that use Guardian.Permissions (via use Guardian.Permissions) and route attacker-influenced data into encode_permissions!/1 or encode_permissions_into_claims!/2, for example by reading a permissions map from a request body and passing it into token issuance."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.4.1",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Yordis Prieto"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (\u003ctt\u003eGuardian.Permissions\u003c/tt\u003e module) allows a denial of service via BEAM atom-table exhaustion.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program file \u003ctt\u003elib/guardian/permissions.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Guardian.Permissions\u0027:encode_permissions!/1\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Guardian.Permissions\u0027:encode_permissions_into_claims!/2\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Guardian.Permissions\u0027:do_encode_permissions!/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003eGuardian.Permissions\u003c/tt\u003e mixin installs a public \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e function on every module that does \u003ctt\u003euse Guardian.Permissions\u003c/tt\u003e. For each key of the supplied map, \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e calls \u003ctt\u003eString.to_atom(to_string(k))\u003c/tt\u003e before any validation runs. The integer-value clause of \u003ctt\u003edo_encode_permissions!/2\u003c/tt\u003e then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e (for example a permissions map read from a request body and passed into token issuance via \u003ctt\u003eencode_permissions_into_claims!/2\u003c/tt\u003e) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling \u003ctt\u003edecode_permissions/1\u003c/tt\u003e is not affected because it skips keys absent from the configured permission set.\u003c/p\u003e\u003cp\u003eThis issue affects guardian: from 2.0.0 before 2.4.1.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion.\n\nThis vulnerability is associated with program file lib/guardian/permissions.ex and program routines \u0027Elixir.Guardian.Permissions\u0027:encode_permissions!/1, \u0027Elixir.Guardian.Permissions\u0027:encode_permissions_into_claims!/2, \u0027Elixir.Guardian.Permissions\u0027:do_encode_permissions!/2.\n\nThe Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set.\n\nThis issue affects guardian: from 2.0.0 before 2.4.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T18:46:24.291Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-9qx2-v587-q3gg"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-55734.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-55734"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ueberauth/guardian/commit/8d4efbfc352d30f5fcfc75a4d69a795b0e472724"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eBefore calling \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e or \u003ctt\u003eencode_permissions_into_claims!/2\u003c/tt\u003e, filter the permission map so that only keys belonging to the configured permission set are passed in, discarding any unknown keys. Avoid passing attacker-influenced permission maps into these functions.\u003c/p\u003e"
            }
          ],
          "value": "Before calling encode_permissions!/1 or encode_permissions_into_claims!/2, filter the permission map so that only keys belonging to the configured permission set are passed in, discarding any unknown keys. Avoid passing attacker-influenced permission maps into these functions."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-55734",
    "datePublished": "2026-08-01T18:46:24.291Z",
    "dateReserved": "2026-06-17T10:44:34.365Z",
    "dateUpdated": "2026-08-03T16:49:59.913Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55733 (GCVE-0-2026-55733)

Vulnerability from nvd – Published: 2026-08-01 18:46 – Updated: 2026-08-03 16:50

Title

Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation

Summary

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 16:50 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

EEF

References

4 references

URL	Tags
https://github.com/ueberauth/guardian/security/ad…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-55733.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-55733	related
https://github.com/ueberauth/guardian/commit/9cd2…	patch

Impacted products

2 products

Vendor	Product	Version
ueberauth	guardian	Affected: 2.0.0 , < 2.4.1 (semver) cpe:2.3:a:ueberauth:guardian::::::::
ueberauth	guardian	Affected: b7a6128ca4d0ffb7f7df5219dd982304ff9d6802 , < 9cd268557846aa4c3ad53566c08f2c190ee5513f (git) cpe:2.3:a:ueberauth:guardian::::::::

Credits

Peter Ullrich Yordis Prieto Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55733",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T16:50:27.758398Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T16:50:53.942Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-fjr5-7xrc-hmpj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027"
          ],
          "packageName": "guardian",
          "packageURL": "pkg:hex/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian/permissions/atom_encoding.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode/3"
            },
            {
              "name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode_value/3"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "2.4.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027"
          ],
          "packageName": "ueberauth/guardian",
          "packageURL": "pkg:github/ueberauth/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian/permissions/atom_encoding.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode/3"
            },
            {
              "name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode_value/3"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "9cd268557846aa4c3ad53566c08f2c190ee5513f",
              "status": "affected",
              "version": "b7a6128ca4d0ffb7f7df5219dd982304ff9d6802",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOnly applications that opt into the non-default \u003ctt\u003eGuardian.Permissions.AtomEncoding\u003c/tt\u003e encoder (via \u003ctt\u003euse Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding\u003c/tt\u003e) and pass attacker-influenced permission scopes into its \u003ctt\u003eencode/3\u003c/tt\u003e entry point are exploitable. The default \u003ctt\u003eGuardian.Permissions.BitwiseEncoding\u003c/tt\u003e encoder and the \u003ctt\u003eGuardian.Permissions.TextEncoding\u003c/tt\u003e encoder do not create atoms and are not affected.\u003c/p\u003e"
            }
          ],
          "value": "Only applications that opt into the non-default Guardian.Permissions.AtomEncoding encoder (via use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding) and pass attacker-influenced permission scopes into its encode/3 entry point are exploitable. The default Guardian.Permissions.BitwiseEncoding encoder and the Guardian.Permissions.TextEncoding encoder do not create atoms and are not affected."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.4.1",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Yordis Prieto"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eGuardian.Permissions.AtomEncoding\u003c/tt\u003e encodes permission scopes by passing arbitrary binaries to \u003ctt\u003eString.to_atom/1\u003c/tt\u003e. When \u003ctt\u003eencode/3\u003c/tt\u003e in \u003ctt\u003elib/guardian/permissions/atom_encoding.ex\u003c/tt\u003e is called with a list, each binary entry is handled by the \u003ctt\u003eencode_value/3\u003c/tt\u003e binary clause, which calls \u003ctt\u003eString.to_atom(value)\u003c/tt\u003e with no allow-list check. The \u003ctt\u003eperm_set\u003c/tt\u003e argument (the application\u0027s small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with \u003ctt\u003euse Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding\u003c/tt\u003e and reached through the imported \u003ctt\u003eencode/3\u003c/tt\u003e entry point.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eString.to_atom/1\u003c/tt\u003e creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into \u003ctt\u003eencode/3\u003c/tt\u003e therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with \u003ctt\u003esystem_limit\u003c/tt\u003e, taking down every application running on it.\u003c/p\u003e\u003cp\u003eThe default encoder is \u003ctt\u003eGuardian.Permissions.BitwiseEncoding\u003c/tt\u003e, which is not affected.\u003c/p\u003e\u003cp\u003eThis issue affects guardian: from 2.0.0 before 2.4.1.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.\n\nGuardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application\u0027s small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point.\n\nString.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it.\n\nThe default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected.\n\nThis issue affects guardian: from 2.0.0 before 2.4.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T18:46:12.113Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-fjr5-7xrc-hmpj"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-55733.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-55733"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ueberauth/guardian/commit/9cd268557846aa4c3ad53566c08f2c190ee5513f"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSwitch the permission encoder to the default \u003ctt\u003eGuardian.Permissions.BitwiseEncoding\u003c/tt\u003e or to \u003ctt\u003eGuardian.Permissions.TextEncoding\u003c/tt\u003e, neither of which creates atoms. Alternatively, validate every permission value against the configured \u003ctt\u003eperm_set\u003c/tt\u003e allowlist (rejecting unknown values) before passing it to \u003ctt\u003eencode/3\u003c/tt\u003e.\u003c/p\u003e"
            }
          ],
          "value": "Switch the permission encoder to the default Guardian.Permissions.BitwiseEncoding or to Guardian.Permissions.TextEncoding, neither of which creates atoms. Alternatively, validate every permission value against the configured perm_set allowlist (rejecting unknown values) before passing it to encode/3."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-55733",
    "datePublished": "2026-08-01T18:46:12.113Z",
    "dateReserved": "2026-06-17T10:44:34.365Z",
    "dateUpdated": "2026-08-03T16:50:53.942Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54894 (GCVE-0-2026-54894)

Vulnerability from nvd – Published: 2026-08-01 18:46 – Updated: 2026-08-03 17:49

Title

Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys

Summary

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 17:49 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

EEF

References

4 references

URL	Tags
https://github.com/ueberauth/guardian/security/ad…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-54894.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-54894	related
https://github.com/ueberauth/guardian/commit/2952…	patch

Impacted products

2 products

Vendor	Product	Version
ueberauth	guardian	Affected: 0.1.0 , < 2.4.1 (semver) cpe:2.3:a:ueberauth:guardian::::::::
ueberauth	guardian	Affected: 7126fa433afc2563fcac0c9aa35193965f8fd5f8 , < 2952657e42e6341a67e6aaad09d8f0b40ae917cb (git) cpe:2.3:a:ueberauth:guardian::::::::

Credits

Peter Ullrich Yordis Prieto Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54894",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T17:49:32.217048Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T17:49:54.220Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-xqch-c77q-rgh5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian.Plug.Keys\u0027"
          ],
          "packageName": "guardian",
          "packageURL": "pkg:hex/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian/plug/keys.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:base_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:claims_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:resource_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:token_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:key_from_other/1"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "2.4.1",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian.Plug.Keys\u0027"
          ],
          "packageName": "ueberauth/guardian",
          "packageURL": "pkg:github/ueberauth/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian/plug/keys.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:base_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:claims_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:resource_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:token_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:key_from_other/1"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "2952657e42e6341a67e6aaad09d8f0b40ae917cb",
              "status": "affected",
              "version": "7126fa433afc2563fcac0c9aa35193965f8fd5f8",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOnly applications that derive a Guardian key (the conn/session namespace) from attacker-influenced data are exploitable. This is the case when a caller-supplied value such as a tenant identifier, request header, or other request input is passed as the \u003ctt\u003e:key\u003c/tt\u003e option to entry points like \u003ctt\u003eGuardian.Plug.current_token/2\u003c/tt\u003e. Applications that use a static namespace (the default \u003ctt\u003e:default\u003c/tt\u003e key or hardcoded atoms) are not affected.\u003c/p\u003e"
            }
          ],
          "value": "Only applications that derive a Guardian key (the conn/session namespace) from attacker-influenced data are exploitable. This is the case when a caller-supplied value such as a tenant identifier, request header, or other request input is passed as the :key option to entry points like Guardian.Plug.current_token/2. Applications that use a static namespace (the default :default key or hardcoded atoms) are not affected."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.4.1",
                  "versionStartIncluding": "0.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Yordis Prieto"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eGuardian.Plug.Keys\u003c/tt\u003e derives connection and session namespace keys by passing arbitrary binaries to \u003ctt\u003eString.to_atom/1\u003c/tt\u003e. \u003ctt\u003ebase_key/1\u003c/tt\u003e in \u003ctt\u003elib/guardian/plug/keys.ex\u003c/tt\u003e converts any binary into the atom \u003ctt\u003e:\"guardian_\u0026lt;input\u0026gt;\"\u003c/tt\u003e, and the derived helpers \u003ctt\u003eclaims_key/1\u003c/tt\u003e, \u003ctt\u003eresource_key/1\u003c/tt\u003e, and \u003ctt\u003etoken_key/1\u003c/tt\u003e create a second atom on top of that. \u003ctt\u003ekey_from_other/1\u003c/tt\u003e likewise converts a regex-captured binary through \u003ctt\u003eString.to_atom/1\u003c/tt\u003e. The public specs advertise \u003ctt\u003eString.t()\u003c/tt\u003e as a valid argument, so passing a string is documented usage, and higher-level entry points such as \u003ctt\u003eGuardian.Plug.current_token(conn, key: key)\u003c/tt\u003e thread the caller-supplied key straight into these functions.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eString.to_atom/1\u003c/tt\u003e creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it.\u003c/p\u003e\u003cp\u003eThis issue affects guardian: from 0.1.0 before 2.4.1.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input.\n\nGuardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :\"guardian_\u003cinput\u003e\", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions.\n\nString.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it.\n\nThis issue affects guardian: from 0.1.0 before 2.4.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T18:46:05.861Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-xqch-c77q-rgh5"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-54894.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-54894"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ueberauth/guardian/commit/2952657e42e6341a67e6aaad09d8f0b40ae917cb"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDo not derive Guardian keys from untrusted input. Use a fixed, hardcoded set of namespace keys, or validate the value against a bounded allowlist of known keys, before passing it as the \u003ctt\u003e:key\u003c/tt\u003e option.\u003c/p\u003e"
            }
          ],
          "value": "Do not derive Guardian keys from untrusted input. Use a fixed, hardcoded set of namespace keys, or validate the value against a bounded allowlist of known keys, before passing it as the :key option."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-54894",
    "datePublished": "2026-08-01T18:46:05.861Z",
    "dateReserved": "2026-06-16T10:47:13.915Z",
    "dateUpdated": "2026-08-03T17:49:54.220Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55734 (GCVE-0-2026-55734)

Vulnerability from cvelistv5 – Published: 2026-08-01 18:46 – Updated: 2026-08-03 16:49

Title

guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1

Summary

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 16:49 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

EEF

References

4 references

URL	Tags
https://github.com/ueberauth/guardian/security/ad…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-55734.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-55734	related
https://github.com/ueberauth/guardian/commit/8d4e…	patch

Impacted products

2 products

Vendor	Product	Version
ueberauth	guardian	Affected: 2.0.0 , < 2.4.1 (semver) cpe:2.3:a:ueberauth:guardian::::::::
ueberauth	guardian	Affected: b7a6128ca4d0ffb7f7df5219dd982304ff9d6802 , < 8d4efbfc352d30f5fcfc75a4d69a795b0e472724 (git) cpe:2.3:a:ueberauth:guardian::::::::

Credits

Peter Ullrich Yordis Prieto Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55734",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T16:49:36.457207Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T16:49:59.913Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-9qx2-v587-q3gg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian.Permissions\u0027"
          ],
          "packageName": "guardian",
          "packageURL": "pkg:hex/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian/permissions.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian.Permissions\u0027:encode_permissions!/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Permissions\u0027:encode_permissions_into_claims!/2"
            },
            {
              "name": "\u0027Elixir.Guardian.Permissions\u0027:do_encode_permissions!/2"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "2.4.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian.Permissions\u0027"
          ],
          "packageName": "ueberauth/guardian",
          "packageURL": "pkg:github/ueberauth/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian/permissions.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian.Permissions\u0027:encode_permissions!/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Permissions\u0027:encode_permissions_into_claims!/2"
            },
            {
              "name": "\u0027Elixir.Guardian.Permissions\u0027:do_encode_permissions!/2"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "8d4efbfc352d30f5fcfc75a4d69a795b0e472724",
              "status": "affected",
              "version": "b7a6128ca4d0ffb7f7df5219dd982304ff9d6802",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThis vulnerability is only exploitable in applications that use \u003ctt\u003eGuardian.Permissions\u003c/tt\u003e (via \u003ctt\u003euse Guardian.Permissions\u003c/tt\u003e) and route attacker-influenced data into \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e or \u003ctt\u003eencode_permissions_into_claims!/2\u003c/tt\u003e, for example by reading a permissions map from a request body and passing it into token issuance.\u003c/p\u003e"
            }
          ],
          "value": "This vulnerability is only exploitable in applications that use Guardian.Permissions (via use Guardian.Permissions) and route attacker-influenced data into encode_permissions!/1 or encode_permissions_into_claims!/2, for example by reading a permissions map from a request body and passing it into token issuance."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.4.1",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Yordis Prieto"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (\u003ctt\u003eGuardian.Permissions\u003c/tt\u003e module) allows a denial of service via BEAM atom-table exhaustion.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program file \u003ctt\u003elib/guardian/permissions.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Guardian.Permissions\u0027:encode_permissions!/1\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Guardian.Permissions\u0027:encode_permissions_into_claims!/2\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Guardian.Permissions\u0027:do_encode_permissions!/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003eGuardian.Permissions\u003c/tt\u003e mixin installs a public \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e function on every module that does \u003ctt\u003euse Guardian.Permissions\u003c/tt\u003e. For each key of the supplied map, \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e calls \u003ctt\u003eString.to_atom(to_string(k))\u003c/tt\u003e before any validation runs. The integer-value clause of \u003ctt\u003edo_encode_permissions!/2\u003c/tt\u003e then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e (for example a permissions map read from a request body and passed into token issuance via \u003ctt\u003eencode_permissions_into_claims!/2\u003c/tt\u003e) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling \u003ctt\u003edecode_permissions/1\u003c/tt\u003e is not affected because it skips keys absent from the configured permission set.\u003c/p\u003e\u003cp\u003eThis issue affects guardian: from 2.0.0 before 2.4.1.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion.\n\nThis vulnerability is associated with program file lib/guardian/permissions.ex and program routines \u0027Elixir.Guardian.Permissions\u0027:encode_permissions!/1, \u0027Elixir.Guardian.Permissions\u0027:encode_permissions_into_claims!/2, \u0027Elixir.Guardian.Permissions\u0027:do_encode_permissions!/2.\n\nThe Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set.\n\nThis issue affects guardian: from 2.0.0 before 2.4.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T18:46:24.291Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-9qx2-v587-q3gg"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-55734.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-55734"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ueberauth/guardian/commit/8d4efbfc352d30f5fcfc75a4d69a795b0e472724"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eBefore calling \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e or \u003ctt\u003eencode_permissions_into_claims!/2\u003c/tt\u003e, filter the permission map so that only keys belonging to the configured permission set are passed in, discarding any unknown keys. Avoid passing attacker-influenced permission maps into these functions.\u003c/p\u003e"
            }
          ],
          "value": "Before calling encode_permissions!/1 or encode_permissions_into_claims!/2, filter the permission map so that only keys belonging to the configured permission set are passed in, discarding any unknown keys. Avoid passing attacker-influenced permission maps into these functions."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-55734",
    "datePublished": "2026-08-01T18:46:24.291Z",
    "dateReserved": "2026-06-17T10:44:34.365Z",
    "dateUpdated": "2026-08-03T16:49:59.913Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55733 (GCVE-0-2026-55733)

Vulnerability from cvelistv5 – Published: 2026-08-01 18:46 – Updated: 2026-08-03 16:50

Title

Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation

Summary

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 16:50 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

EEF

References

4 references

URL	Tags
https://github.com/ueberauth/guardian/security/ad…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-55733.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-55733	related
https://github.com/ueberauth/guardian/commit/9cd2…	patch

Impacted products

2 products

Vendor	Product	Version
ueberauth	guardian	Affected: 2.0.0 , < 2.4.1 (semver) cpe:2.3:a:ueberauth:guardian::::::::
ueberauth	guardian	Affected: b7a6128ca4d0ffb7f7df5219dd982304ff9d6802 , < 9cd268557846aa4c3ad53566c08f2c190ee5513f (git) cpe:2.3:a:ueberauth:guardian::::::::

Credits

Peter Ullrich Yordis Prieto Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55733",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T16:50:27.758398Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T16:50:53.942Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-fjr5-7xrc-hmpj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027"
          ],
          "packageName": "guardian",
          "packageURL": "pkg:hex/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian/permissions/atom_encoding.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode/3"
            },
            {
              "name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode_value/3"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "2.4.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027"
          ],
          "packageName": "ueberauth/guardian",
          "packageURL": "pkg:github/ueberauth/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian/permissions/atom_encoding.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode/3"
            },
            {
              "name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode_value/3"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "9cd268557846aa4c3ad53566c08f2c190ee5513f",
              "status": "affected",
              "version": "b7a6128ca4d0ffb7f7df5219dd982304ff9d6802",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOnly applications that opt into the non-default \u003ctt\u003eGuardian.Permissions.AtomEncoding\u003c/tt\u003e encoder (via \u003ctt\u003euse Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding\u003c/tt\u003e) and pass attacker-influenced permission scopes into its \u003ctt\u003eencode/3\u003c/tt\u003e entry point are exploitable. The default \u003ctt\u003eGuardian.Permissions.BitwiseEncoding\u003c/tt\u003e encoder and the \u003ctt\u003eGuardian.Permissions.TextEncoding\u003c/tt\u003e encoder do not create atoms and are not affected.\u003c/p\u003e"
            }
          ],
          "value": "Only applications that opt into the non-default Guardian.Permissions.AtomEncoding encoder (via use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding) and pass attacker-influenced permission scopes into its encode/3 entry point are exploitable. The default Guardian.Permissions.BitwiseEncoding encoder and the Guardian.Permissions.TextEncoding encoder do not create atoms and are not affected."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.4.1",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Yordis Prieto"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eGuardian.Permissions.AtomEncoding\u003c/tt\u003e encodes permission scopes by passing arbitrary binaries to \u003ctt\u003eString.to_atom/1\u003c/tt\u003e. When \u003ctt\u003eencode/3\u003c/tt\u003e in \u003ctt\u003elib/guardian/permissions/atom_encoding.ex\u003c/tt\u003e is called with a list, each binary entry is handled by the \u003ctt\u003eencode_value/3\u003c/tt\u003e binary clause, which calls \u003ctt\u003eString.to_atom(value)\u003c/tt\u003e with no allow-list check. The \u003ctt\u003eperm_set\u003c/tt\u003e argument (the application\u0027s small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with \u003ctt\u003euse Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding\u003c/tt\u003e and reached through the imported \u003ctt\u003eencode/3\u003c/tt\u003e entry point.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eString.to_atom/1\u003c/tt\u003e creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into \u003ctt\u003eencode/3\u003c/tt\u003e therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with \u003ctt\u003esystem_limit\u003c/tt\u003e, taking down every application running on it.\u003c/p\u003e\u003cp\u003eThe default encoder is \u003ctt\u003eGuardian.Permissions.BitwiseEncoding\u003c/tt\u003e, which is not affected.\u003c/p\u003e\u003cp\u003eThis issue affects guardian: from 2.0.0 before 2.4.1.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.\n\nGuardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application\u0027s small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point.\n\nString.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it.\n\nThe default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected.\n\nThis issue affects guardian: from 2.0.0 before 2.4.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T18:46:12.113Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-fjr5-7xrc-hmpj"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-55733.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-55733"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ueberauth/guardian/commit/9cd268557846aa4c3ad53566c08f2c190ee5513f"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSwitch the permission encoder to the default \u003ctt\u003eGuardian.Permissions.BitwiseEncoding\u003c/tt\u003e or to \u003ctt\u003eGuardian.Permissions.TextEncoding\u003c/tt\u003e, neither of which creates atoms. Alternatively, validate every permission value against the configured \u003ctt\u003eperm_set\u003c/tt\u003e allowlist (rejecting unknown values) before passing it to \u003ctt\u003eencode/3\u003c/tt\u003e.\u003c/p\u003e"
            }
          ],
          "value": "Switch the permission encoder to the default Guardian.Permissions.BitwiseEncoding or to Guardian.Permissions.TextEncoding, neither of which creates atoms. Alternatively, validate every permission value against the configured perm_set allowlist (rejecting unknown values) before passing it to encode/3."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-55733",
    "datePublished": "2026-08-01T18:46:12.113Z",
    "dateReserved": "2026-06-17T10:44:34.365Z",
    "dateUpdated": "2026-08-03T16:50:53.942Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54894 (GCVE-0-2026-54894)

Vulnerability from cvelistv5 – Published: 2026-08-01 18:46 – Updated: 2026-08-03 17:49

Title

Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys

Summary

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 17:49 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

EEF

References

4 references

URL	Tags
https://github.com/ueberauth/guardian/security/ad…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-54894.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-54894	related
https://github.com/ueberauth/guardian/commit/2952…	patch

Impacted products

2 products

Vendor	Product	Version
ueberauth	guardian	Affected: 0.1.0 , < 2.4.1 (semver) cpe:2.3:a:ueberauth:guardian::::::::
ueberauth	guardian	Affected: 7126fa433afc2563fcac0c9aa35193965f8fd5f8 , < 2952657e42e6341a67e6aaad09d8f0b40ae917cb (git) cpe:2.3:a:ueberauth:guardian::::::::

Credits

Peter Ullrich Yordis Prieto Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54894",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T17:49:32.217048Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T17:49:54.220Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-xqch-c77q-rgh5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian.Plug.Keys\u0027"
          ],
          "packageName": "guardian",
          "packageURL": "pkg:hex/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian/plug/keys.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:base_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:claims_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:resource_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:token_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:key_from_other/1"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "2.4.1",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian.Plug.Keys\u0027"
          ],
          "packageName": "ueberauth/guardian",
          "packageURL": "pkg:github/ueberauth/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian/plug/keys.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:base_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:claims_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:resource_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:token_key/1"
            },
            {
              "name": "\u0027Elixir.Guardian.Plug.Keys\u0027:key_from_other/1"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "2952657e42e6341a67e6aaad09d8f0b40ae917cb",
              "status": "affected",
              "version": "7126fa433afc2563fcac0c9aa35193965f8fd5f8",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOnly applications that derive a Guardian key (the conn/session namespace) from attacker-influenced data are exploitable. This is the case when a caller-supplied value such as a tenant identifier, request header, or other request input is passed as the \u003ctt\u003e:key\u003c/tt\u003e option to entry points like \u003ctt\u003eGuardian.Plug.current_token/2\u003c/tt\u003e. Applications that use a static namespace (the default \u003ctt\u003e:default\u003c/tt\u003e key or hardcoded atoms) are not affected.\u003c/p\u003e"
            }
          ],
          "value": "Only applications that derive a Guardian key (the conn/session namespace) from attacker-influenced data are exploitable. This is the case when a caller-supplied value such as a tenant identifier, request header, or other request input is passed as the :key option to entry points like Guardian.Plug.current_token/2. Applications that use a static namespace (the default :default key or hardcoded atoms) are not affected."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.4.1",
                  "versionStartIncluding": "0.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Yordis Prieto"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eGuardian.Plug.Keys\u003c/tt\u003e derives connection and session namespace keys by passing arbitrary binaries to \u003ctt\u003eString.to_atom/1\u003c/tt\u003e. \u003ctt\u003ebase_key/1\u003c/tt\u003e in \u003ctt\u003elib/guardian/plug/keys.ex\u003c/tt\u003e converts any binary into the atom \u003ctt\u003e:\"guardian_\u0026lt;input\u0026gt;\"\u003c/tt\u003e, and the derived helpers \u003ctt\u003eclaims_key/1\u003c/tt\u003e, \u003ctt\u003eresource_key/1\u003c/tt\u003e, and \u003ctt\u003etoken_key/1\u003c/tt\u003e create a second atom on top of that. \u003ctt\u003ekey_from_other/1\u003c/tt\u003e likewise converts a regex-captured binary through \u003ctt\u003eString.to_atom/1\u003c/tt\u003e. The public specs advertise \u003ctt\u003eString.t()\u003c/tt\u003e as a valid argument, so passing a string is documented usage, and higher-level entry points such as \u003ctt\u003eGuardian.Plug.current_token(conn, key: key)\u003c/tt\u003e thread the caller-supplied key straight into these functions.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eString.to_atom/1\u003c/tt\u003e creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it.\u003c/p\u003e\u003cp\u003eThis issue affects guardian: from 0.1.0 before 2.4.1.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input.\n\nGuardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :\"guardian_\u003cinput\u003e\", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions.\n\nString.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it.\n\nThis issue affects guardian: from 0.1.0 before 2.4.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T18:46:05.861Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-xqch-c77q-rgh5"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-54894.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-54894"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ueberauth/guardian/commit/2952657e42e6341a67e6aaad09d8f0b40ae917cb"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDo not derive Guardian keys from untrusted input. Use a fixed, hardcoded set of namespace keys, or validate the value against a bounded allowlist of known keys, before passing it as the \u003ctt\u003e:key\u003c/tt\u003e option.\u003c/p\u003e"
            }
          ],
          "value": "Do not derive Guardian keys from untrusted input. Use a fixed, hardcoded set of namespace keys, or validate the value against a bounded allowlist of known keys, before passing it as the :key option."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-54894",
    "datePublished": "2026-08-01T18:46:05.861Z",
    "dateReserved": "2026-06-16T10:47:13.915Z",
    "dateUpdated": "2026-08-03T17:49:54.220Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55735 (GCVE-0-2026-55735)

Vulnerability from cvelistv5 – Published: 2026-08-01 18:46 – Updated: 2026-08-03 19:30

Title

Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation

Summary

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 19:29 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

EEF

References

4 references

URL	Tags
https://github.com/ueberauth/guardian/security/ad…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-55735.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-55735	related
https://github.com/ueberauth/guardian/commit/2bd7…	patch

Impacted products

2 products

Vendor	Product	Version
ueberauth	guardian	Affected: 1.0.0 , < 2.4.1 (semver) cpe:2.3:a:ueberauth:guardian::::::::
ueberauth	guardian	Affected: d65227145f72b290106c06cecbe42728fbf05fe2 , < 2bd7a8c29770d423d855c0a4965caa6c3e486901 (git) cpe:2.3:a:ueberauth:guardian::::::::

Credits

Peter Ullrich Yordis Prieto Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55735",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T19:29:43.841542Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T19:30:07.608Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-7975-hp3r-5qhv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian\u0027"
          ],
          "packageName": "guardian",
          "packageURL": "pkg:hex/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian\u0027:revoke/3"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "2.4.1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Guardian\u0027"
          ],
          "packageName": "ueberauth/guardian",
          "packageURL": "pkg:github/ueberauth/guardian",
          "product": "guardian",
          "programFiles": [
            "lib/guardian.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Guardian\u0027:revoke/3"
            }
          ],
          "repo": "https://github.com/ueberauth/guardian",
          "vendor": "ueberauth",
          "versions": [
            {
              "lessThan": "2bd7a8c29770d423d855c0a4965caa6c3e486901",
              "status": "affected",
              "version": "d65227145f72b290106c06cecbe42728fbf05fe2",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application must route a caller-supplied token into \u003ctt\u003eGuardian.revoke/3\u003c/tt\u003e (for example a logout or session-revocation endpoint) and use a token module whose \u003ctt\u003erevoke\u003c/tt\u003e / \u003ctt\u003eon_revoke\u003c/tt\u003e callback mutates state keyed by the token claims (a whitelist that deletes by \u003ctt\u003ejti\u003c/tt\u003e or a blacklist that inserts by \u003ctt\u003ejti\u003c/tt\u003e, such as a GuardianDb-style store). With the default no-op \u003ctt\u003eon_revoke\u003c/tt\u003e callback, no session state is changed and the issue is not exploitable.\u003c/p\u003e"
            }
          ],
          "value": "The application must route a caller-supplied token into Guardian.revoke/3 (for example a logout or session-revocation endpoint) and use a token module whose revoke / on_revoke callback mutates state keyed by the token claims (a whitelist that deletes by jti or a blacklist that inserts by jti, such as a GuardianDb-style store). With the default no-op on_revoke callback, no session state is changed and the issue is not exploitable."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.4.1",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Yordis Prieto"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim\u0027s session with a forged token.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eGuardian.revoke/3\u003c/tt\u003e in \u003ctt\u003elib/guardian.ex\u003c/tt\u003e decodes the supplied token with \u003ctt\u003epeek/1\u003c/tt\u003e, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module\u0027s \u003ctt\u003erevoke\u003c/tt\u003e callback and the implementation\u0027s \u003ctt\u003eon_revoke\u003c/tt\u003e callback, a state-mutating sink. The sibling operations \u003ctt\u003erefresh/2\u003c/tt\u003e and \u003ctt\u003eexchange/4\u003c/tt\u003e both call \u003ctt\u003edecode_and_verify\u003c/tt\u003e first, so the signature is checked before anything acts on the claims; \u003ctt\u003erevoke/3\u003c/tt\u003e is the only state-mutating path that acts on claims without verifying the signature.\u003c/p\u003e\u003cp\u003eAn attacker who knows or guesses a victim\u0027s identifying claim values (\u003ctt\u003ejti\u003c/tt\u003e, \u003ctt\u003esub\u003c/tt\u003e) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into \u003ctt\u003eGuardian.revoke/3\u003c/tt\u003e (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim\u0027s legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret.\u003c/p\u003e\u003cp\u003eThis issue affects guardian: from 1.0.0 before 2.4.1.\u003c/p\u003e"
            }
          ],
          "value": "Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim\u0027s session with a forged token.\n\nGuardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module\u0027s revoke callback and the implementation\u0027s on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature.\n\nAn attacker who knows or guesses a victim\u0027s identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim\u0027s legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret.\n\nThis issue affects guardian: from 1.0.0 before 2.4.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-475",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-475 Signature Spoofing by Improper Validation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T18:46:05.234Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-7975-hp3r-5qhv"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-55735.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-55735"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ueberauth/guardian/commit/2bd7a8c29770d423d855c0a4965caa6c3e486901"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eVerify the token before revoking it: call \u003ctt\u003edecode_and_verify\u003c/tt\u003e (or a verify-without-expiry variant, so already-expired tokens remain revocable) on the caller-supplied token and pass only tokens whose signature validates into \u003ctt\u003eGuardian.revoke/3\u003c/tt\u003e. Reject tokens with an invalid signature at the application boundary.\u003c/p\u003e"
            }
          ],
          "value": "Verify the token before revoking it: call decode_and_verify (or a verify-without-expiry variant, so already-expired tokens remain revocable) on the caller-supplied token and pass only tokens whose signature validates into Guardian.revoke/3. Reject tokens with an invalid signature at the application boundary."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-55735",
    "datePublished": "2026-08-01T18:46:05.234Z",
    "dateReserved": "2026-06-17T10:44:34.365Z",
    "dateUpdated": "2026-08-03T19:30:07.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

8 vulnerabilities found for guardian by ueberauth

CVE-2026-55735 (GCVE-0-2026-55735)

CVE-2026-55734 (GCVE-0-2026-55734)

CVE-2026-55733 (GCVE-0-2026-55733)

CVE-2026-54894 (GCVE-0-2026-54894)

CVE-2026-55734 (GCVE-0-2026-55734)

CVE-2026-55733 (GCVE-0-2026-55733)

CVE-2026-54894 (GCVE-0-2026-54894)

CVE-2026-55735 (GCVE-0-2026-55735)