The vulnerability arises from Guardian.Permissions.AtomEncoding, which turns arbitrary binary data into atoms without any whitelisting. This creates a new atom for each unique string, exhausting the Erlang atom table and ultimately forcing the BEAM node to crash with a system limit. The impact is a denial of service that brings down every application running on the affected node. The weakness corresponds to CWE‑770, Allocation of Resources Without Limits or Throttling.

UEberAuth Guardian instances from version 2.0.0 up to, but excluding, 2.4.1 are vulnerable when using the AtomEncoding permission encoder. The vulnerability does not affect the default BitwiseEncoding or TextEncoding encoders.

The CVSS score of 6.9 classifies this as a medium‑severity flaw, while the EPSS score of less than 1% indicates a low probability of current exploitation. The vulnerability is not listed in CISA's KEV catalog. An attacker must supply malicious permission data—via a request body, a JWT claim, or other external input—to trigger the encoder and cause atom table exhaustion. The required conditions are readily satisfiable in a typical Guardian deployment, making the threat realistic even though the exploitability likelihood remains modest.