https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T21:23:59.747144+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-230741 EUVD-2026-230741 2026-10-17T21:23:59.764729+00:00 EUVD-2026-230741 https://cve.radiocsirt.org/vuln/fkie_cve-2025-32782 fkie_cve-2025-32782 2026-10-17T21:23:59.764761+00:00

Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request triggered by clicking a link sent via email. Some email clients and security tools (e.g., Outlook, virus scanners, and email previewers) may automatically follow these links, unintentionally confirming the account. This allows an attacker to register an account using another user’s email and potentially have it auto-confirmed by the victim’s email client. This does not allow attackers to take over or access existing accounts or private data. It is limited to account confirmation of new accounts only. This vulnerability is fixed in 4.7.0.

 https://cve.radiocsirt.org/vuln/ghsa-3988-q8q7-p787 GHSA-3988-q8q7-p787 — ash_authentication has email link auto-click account confirmation vulnerability 2026-10-17T21:23:59.764797+00:00

Affected: Hex: ash_authentication

### Impact

The confirmation flow for account creation currently uses a GET request triggered by clicking a link sent via email. Some email clients and security tools (e.g., Outlook, virus scanners, and email previewers) may automatically follow these links, unintentionally confirming the account. This allows an attacker to register an account using another user’s email and potentially have it auto-confirmed by the victim’s email client.

This does not allow attackers to take over or access existing accounts or private data. It is limited to account confirmation of new accounts only.

### Patches A mitigation has been released in version `4.7.0`. You will also need to upgrade to `2.6.0` or later of `ash_authentication_phoenix` to take advantage of the autogenerated views for confirmation. The fix updates the confirmation flow to require explicit user interaction (such as clicking a button on the confirmation page) rather than performing the confirmation via a GET request. This ensures that automatic link prefetching or scanning by email clients does not unintentionally confirm accounts.

To mitigate, follow these steps:

1. Upgrade `ash_authentication` >= `4.7.0` 2. Upgrade `ash_authentication_phoenix` >= `2.6.0` (if using `ash_authentication_phoenix`) 3. Set `require_interaction? true` in your confirmation strategy. 4. Add `confirm_route` to your router, if using `ash_authentication_phoenix` *above* `auth_routes`.

#### Setting `require_interaction? true`

modify your `conf…