CVE-2026-78223Suited to automated attack · CISA
Token revocation record built from unverified JWT claims in AshAuthentication
CVSS score
6.9
EPSS probability
%0.4
Risk score
0.0
Published
28 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
9.1
CVE-2026-86533
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
T
Patch verifiedEPSS %1
9.1
CVE-2026-76949
Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement
T
Patch verifiedEPSS %1
9.1
CVE-2026-85500
`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
T
Patch verifiedEPSS %1
9.1
CVE-2026-88952
OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication
T
Patch verifiedEPSS %1
8.2
CVE-2026-82760
Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
T
Patch verifiedEPSS %1
9.1
CVE-2026-91039
dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover
T
Patch verifiedEPSS %1
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-78223"