Product
AshAuthentication
An open-source authentication library in the Elixir ecosystem affected by account takeover risk because its OAuth callback does not distinguish between registration and account linking flows.
Timeline (last 90 days)
Oct 12
The three open-source projects Pingvin Share X, Better Auth, and AshAuthentication all trusted the email field returned by the OAuth provider without confirming whether the email was verified (or without distinguishing the registration and linking flows), causing a stranger's OAuth login to be bound to someone else's account and achieving account takeover.
Unverified50%