CVE-2026-85500Suited to automated attack · CISA
`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
CVSS score
9.1
EPSS probability
%0.8
Risk score
0.1
Published
25 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
9.1
CVE-2026-86533
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
T
Patch verifiedEPSS %1
9.1
CVE-2026-76949
Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement
T
Patch verifiedEPSS %1
9.1
CVE-2026-88952
OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication
T
Patch verifiedEPSS %1
8.2
CVE-2026-82760
Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
T
Patch verifiedEPSS %1
9.1
CVE-2026-91039
dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover
T
Patch verifiedEPSS %1
7.4
CVE-2026-86688
Session id is not renewed on authentication in ash_authentication, allowing session fixation
T
Patch verifiedEPSS %1
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2026-85500"