pow-auth/assent vulnerabilities

CVEs whose affected-version data names the pow-auth/assent package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-117656Critical· 9.3

1w ago

Unverified Sign in with Apple callback parameter can override verified ID token claims

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorizati…

▾ Midnightpow-auth · assentEPSS 0.23%via CVEORG