James Harton

Missing Session Revocation on Logout in ash_authentication_phoenix

dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

Session id is not renewed on authentication in ash_authentication, allowing session fixation

Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

Log injection via an unescaped password reset identity in AshAuthentication

`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication

Magic link single-use tokens replayable via TOCTOU race in AshAuthentication

Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in

Reversible IP address pseudonymisation in AshAuthentication audit log hash mode