Threats affecting pkg:hex/assent

CVE-2026-117656 is an authentication bypass vulnerability in the Sign in with Apple strategy of the pow-auth Assent library. The flaw allows an unauthenticated remote attacker to impersonate another user by manipulating the user parameter in the authorization callback. This parameter, controlled by the client, can override verified ID token claims, enabling attackers to replace critical identity attributes such as subject and email. The vulnerability affects versions from 0.1.25 up to but not including 0.3.2 and has been fixed in version 0.3.2.