AIKIDO-2026-316050

TL;DR

In ash_authentication, single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix. The token therefore travels in the request line, where web servers, reverse proxies, request telemetry and the browser's own history record it, all of which outlive the request and are ordinarily less protected than session storage. The redirect destination is restricted to a local path, so this is not an open redirect; the exposure is the retention of a live credential.