Ueberauth vulnerabilities
We track 5 vulnerabilities in Ueberauth products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on August 1, 2026.
Latest Ueberauth vulnerabilities
- 7.5 High severity
guardian: Improper Verification of Cryptographic Signature
Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature
- 7.5 High severity
guardian: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and
- 7.5 High severity
guardian: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to
- 7.5 High severity
guardian: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binarie
- 9.1 Critical severity
ueberauth_apple: Authentication Bypass by Spoofing
Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims. The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback id_token against Apple's JWKS