James Harton

Actor record with password digest stored in AshAuthentication audit log entries

Missing Session Revocation on Logout in ash_authentication_phoenix

Session id is not renewed on authentication in ash_authentication, allowing session fixation

Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

Sign-in token minted for one resource accepted by another in AshAuthentication

Token revocation record built from unverified JWT claims in AshAuthentication

Log injection via an unescaped password reset identity in AshAuthentication