Analysis

Common Weaknesses

The most common CWE weakness classes across Erlang ecosystem CVEs

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Weak Authentication CWE-1390 CWE-1390 at MITRE

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Authentication Bypass by Spoofing: 4 CVEs (36.4%) — click to drill down Authentication Bypass by Capture-replay: 4 CVEs (36.4%) — click to drill down Improper Resolution of Path Equivalence: 1 CVEs (9.1%) — click to drill down Authentication Bypass by Primary Weakness: 1 CVEs (9.1%) — click to drill down Use of Weak Credentials: 1 CVEs (9.1%) — click to drill down Not Using Password Aging: 0 CVEs (0.0%) — click to drill down Password Aging with Long Expiration: 0 CVEs (0.0%) — click to drill down Authentication Bypass by Alternate Name: 0 CVEs (0.0%) — click to drill down Reflection Attack in an Authentication Protocol: 0 CVEs (0.0%) — click to drill down Authentication Bypass by Assumed-Immutable Data: 0 CVEs (0.0%) — click to drill down Incorrect Implementation of Authentication Algorithm: 0 CVEs (0.0%) — click to drill down Improper Restriction of Excessive Authentication Attempts: 0 CVEs (0.0%) — click to drill down Use of Single-factor Authentication: 0 CVEs (0.0%) — click to drill down Use of Password System for Primary Authentication: 0 CVEs (0.0%) — click to drill down Insufficiently Protected Credentials: 0 CVEs (0.0%) — click to drill down Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created: 0 CVEs (0.0%) — click to drill down Use of Client-Side Authentication: 0 CVEs (0.0%) — click to drill down Unverified Password Change: 0 CVEs (0.0%) — click to drill down Weak Password Recovery Mechanism for Forgotten Password: 0 CVEs (0.0%) — click to drill down Guessable CAPTCHA: 0 CVEs (0.0%) — click to drill down Use of Password Hash Instead of Password for Authentication: 0 CVEs (0.0%) — click to drill down Total 11
Authentication Bypass by Spoofing CWE-290 4 (36.4%) Authentication Bypass by Capture-replay CWE-294 4 (36.4%) Improper Resolution of Path Equivalence CWE-41 1 (9.1%) Authentication Bypass by Primary Weakness CWE-305 1 (9.1%) Use of Weak Credentials CWE-1391 1 (9.1%) Not Using Password Aging CWE-262 0 (0.0%) Password Aging with Long Expiration CWE-263 0 (0.0%) Authentication Bypass by Alternate Name CWE-289 0 (0.0%) Reflection Attack in an Authentication Protocol CWE-301 0 (0.0%) Authentication Bypass by Assumed-Immutable Data CWE-302 0 (0.0%) Incorrect Implementation of Authentication Algorithm CWE-303 0 (0.0%) Improper Restriction of Excessive Authentication Attempts CWE-307 0 (0.0%) Use of Single-factor Authentication CWE-308 0 (0.0%) Use of Password System for Primary Authentication CWE-309 0 (0.0%) Insufficiently Protected Credentials CWE-522 0 (0.0%) Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created CWE-593 0 (0.0%) Use of Client-Side Authentication CWE-603 0 (0.0%) Unverified Password Change CWE-620 0 (0.0%) Weak Password Recovery Mechanism for Forgotten Password CWE-640 0 (0.0%) Guessable CAPTCHA CWE-804 0 (0.0%) Use of Password Hash Instead of Password for Authentication CWE-836 0 (0.0%)

CVEs

CVEs for Weak Authentication CWE-1390

Summary Publication CVE ID Published
Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement
Hex / ash_authentication
GitHub / team-alembic/ash_authentication
CVE-2026-76949 2026-09-17
dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover
Hex / ash_authentication
GitHub / team-alembic/ash_authentication
CVE-2026-91039 2026-09-17
`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
Hex / ash_authentication
GitHub / team-alembic/ash_authentication
CVE-2026-85500 2026-09-17
httpd mod_auth directory protection bypassed by a doubled slash in the request path
Erlang
pkg:otp/inets
GitHub / erlang/otp
CVE-2026-66835 2026-09-01
Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions
Hex / samly
GitHub / dropbox/samly
GitHub / handnot2/samly
CVE-2026-53424 2026-08-20
On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay
Hex / mpp
GitHub / zenhive/mpp
CVE-2026-67581 2026-08-19
Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay
Hex / mpp
GitHub / zenhive/mpp
CVE-2026-73136 2026-08-19
Boruta accepts expired JWT client assertions due to missing exp claim validation
Hex / boruta
GitHub / malach-it/boruta_auth
CVE-2026-53431 2026-07-30
Missing ID token claim validation in ueberauth_apple allows account takeover
Hex / ueberauth_apple
GitHub / ueberauth/ueberauth_apple
CVE-2026-55954 2026-07-14
DTLS server cookie bypass during startup window due to empty initial cookie secret
Erlang / ssl
GitHub / erlang/otp
CVE-2026-54887 2026-07-02
OAuth2/OIDC account takeover in AshAuthentication via email-based user matching
Hex / ash_authentication
GitHub / team-alembic/ash_authentication
CVE-2026-49757 2026-06-15
11 CVEs