James Harton

Actor record with password digest stored in AshAuthentication audit log entries

Confirmation token accepted on any record in AshAuthentication

Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

Sign-in token minted for one resource accepted by another in AshAuthentication

Token revocation record built from unverified JWT claims in AshAuthentication

Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

Reflected XSS in AshAuthentication confirmation and magic link interaction forms

Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

OAuth2/OIDC account takeover in AshAuthentication via email-based user matching