AIKIDO-2026-42418
ash_authentication is vulnerable to Cross-Site Scripting (XSS)
21
Low Risk
This Affects:
ash_authenticationTL;DR
In ash_authentication, reflected XSS in AshAuthentication confirmation and magic link interaction forms. When a strategy is configured with require_interaction? set to true, AshAuthentication serves an intermediate HTML page asking the user to confirm the action by submitting a form.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ash_authentication is vulnerable to Cross-Site Scripting (XSS) in versions 4.8.0 - 4.14.1.
How to fix this
Upgrade the ash_authentication library to the patch version.
Links
Fix Commits
github.com/team-alembic/ash_authentication/commit/0bd5199db066be22b2ca1ec8bc6109e5d62e6070github.com/team-alembic/ash_authentication/commit/62719710790a150a9eacab9c0a066e0d122d15be
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.