The vulnerability is a reflected Cross‑Site Scripting flaw in AshAuthentication. Templates that render confirmation and magic‑link forms do not escape a request parameter into a hidden input, allowing an attacker to inject arbitrary HTML or JavaScript. The injected code runs with the same origin as the application, so an attacker can read session cookies, hijack sessions, or perform other client‑side attacks against a victim following a seemingly legitimate link.

The flaw affects the team‑alembic AshAuthentication library in releases from 4.8.0 up to but excluding 4.14.2, and from 5.0.0‑rc.0 up to but excluding 5.0.0‑rc.13. The vulnerability has been observed in applications that embed the library with a configuration option require_interaction? set to true.

The CVSS score of 2.1 indicates a low severity, and the EPSS score is not available; the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, exploitation only requires an unauthenticated attacker to craft a malicious URL and entice a user to click it, which is a common social engineering scenario. Because the injected script executes in the app’s origin context, the impact can be significant if the user is logged in or has a valid session cookie. Given the lack of additional authentication checks during the GET request, the attack vector is considered low barrier but high potential impact on affected users.