CVE-2026-54894: guardian before 2.4.1 (exclusive), 0.1.0 to before 2.4.1

Affected technology

guardian · before 2.4.1 (exclusive)
ueberauth

guardian · 0.1.0 to before 2.4.1
ueberauth

guardian · 7126fa433afc2563fcac0c9aa35193965f8fd5f8 to before 2952657e42e6341a67e6aaad09d8f0b40ae917cb
ueberauth

Component: 'Elixir.Guardian.Plug.Keys'
Function: 'Elixir.Guardian.Plug.Keys':base_key/1, 'Elixir.Guardian.Plug.Keys':claims_key/1, 'Elixir.Guardian.Plug.Keys':resource_key/1, 'Elixir.Guardian.Plug.Keys':token_key/1, 'Elixir.Guardian.Plug.Keys':key_from_other/1
File: lib/guardian/plug/keys.ex

Attack conditions (Source advisory, CVSS 4.0): Local · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could disrupt service. Source advisory’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and integrity impact as none; availability impact as high.