AIKIDO-2026-799190

TL;DR

In ash_authentication, purpose-limited JWT accepted as full bearer authentication in AshAuthentication. This bypasses the library's intended token-exchange contract, in which the sign_in token is meant to be presented exactly once to a preparation that validates the purpose claim and immediately revokes the token. The first use of a still-valid sign-in token presented directly in the Authorization header succeeds because the stateless bearer path never scopes it to purpose == "user".