ash_authentication (Hex) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Hex package ash_authentication, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (3)

• CVE-2026-49757: Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC…
• CVE-2025-25202 — CVSS 6.5 (medium): Ash Authentication is an authentication framework for Elixir applications. Applications which have been bootstrapped by the igniter…
• CVE-2025-32782 — CVSS 5.3 (medium): Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request…