The vulnerability arises from improper neutralization of input during web page generation in ash_authentication's confirmation and magic link forms. These forms embed user-supplied parameters directly into hidden input value attributes without HTML escaping, using EEx templates with plain <%= %> expressions. No validation or signature verification occurs before rendering, allowing an attacker to inject arbitrary markup and scripts via crafted URLs. Because the affected pages are served over GET and do not require authentication, simply visiting a malicious link triggers script execution in the application's origin, exposing cookies, sessions, and same-origin responses. This issue affects ash_authentication versions from 4.8.0 before 4.14.2 and from 5.0.0-rc.0 before 5.0.0-rc.13.

An attacker can execute arbitrary JavaScript in the context of the vulnerable application by tricking users into visiting crafted URLs. This can lead to theft of cookies, session tokens, and access to same-origin data. Since the vulnerable pages are part of the authentication flow, victims may be more likely to trust and follow malicious links. However, the CVSS score indicates the overall severity is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid enabling require_interaction? or restrict access to the affected forms. Consider implementing input validation and proper HTML escaping in templates to prevent injection. Monitor vendor channels for official patches or updates addressing this issue.