Peter Ullrich

Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint

CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection

Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects

Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression

Actor record with password digest stored in AshAuthentication audit log entries

Refresh tokens accepted as private repository credentials at the CDN

Session id is not renewed on authentication in ash_authentication, allowing session fixation

Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

Sign-in token minted for one resource accepted by another in AshAuthentication