Security Digest
Critical Hex (Erlang/Elixir) advisories
6 critical advisories for Hex (Erlang/Elixir) packages since October 2023, newest first. Check your project with mix hex.audit.
- gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads CVE-2026-48853 CVSS 9.2 Critical
grpc>= 0.4.0, < 1.0.0 → fixed in 1.0.0 - AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching CVE-2026-49757 CVSS 9.2 Critical
ash_authentication>= 0.1.0, < 4.14.0 → fixed in 4.14.0;ash_authentication>= 5.0.0-rc.0, < 5.0.0-rc.10 → fixed in 5.0.0-rc.10 - QUIC has Broken TLS verification CVE-2026-49457 CVSS 9.1 Critical
quic<= 1.4.3 → fixed in 1.4.4 - Relyra SAML SignatureValue not cryptographically verified -> authentication bypass CVE-2026-49454 CVSS 9.1 Critical
relyra>= 1.0.0, < 1.2.0 → fixed in 1.2.0 - PhoenixStorybook: Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground CVE-2026-8467 CVSS 9.5 Critical
phoenix_storybook>= 0.5.0, < 1.1.0 → fixed in 1.1.0 - Samly access control vulnerability CVE-2024-25718 CVSS 9.3 Critical
Samly< 1.4.0 → fixed in 1.4.0