CVE-2026-66882

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.8.0 through 4.14.1 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.12

Description Reflected cross-site scripting (XSS) occurs when a strategy is configured with require interaction? set to true. The software serves intermediate HTML pages that embed request parameters directly into hidden input value attributes without HTML escaping. Specifically, the confirm parameter is interpolated in lib/ash authentication/add ons/confirmation/confirmation form.html.eex and the magic link token parameter is interpolated in lib/ash authentication/strategies/magic link/sign in form.html.eex. Because these templates use plain expressions that perform no escaping and the accept/2 functions in AshAuthentication.AddOn.Confirmation.Plug and AshAuthentication.Strategy.MagicLink.Plug do not validate the values, an unauthenticated attacker can craft a URL to inject malicious markup. The injected script executes in the application origin, allowing access to cookies, sessions, and same-origin responses.

Recommendations Update ash authentication to version 4.14.2 or later. Update ash authentication to version 5.0.0-rc.13 or later.