What is the official website of AT&T Business ?

The official website of AT&T Business is https://www.business.att.com/learn/home.html.

What is AT&T Business's cybersecurity risk score?

AT&T Business has an AI-generated cybersecurity risk score of 756 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has AT&T Business experienced?

According to Rankiteo, AT&T Business currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has AT&T Business been affected by any supply chain cyber incidents ?

According to Rankiteo, AT&T Business has been affected by multiple supply chain cyber incidents. The affected supply chain sources and their corresponding incident IDs are: IBM (Incident ID: ATTIBM1781168591) Fortinet (Incident ID: MERCHESAMCOMFOXATTFORTOY1781713752) UUNET (Incident ID: LUMATTVERFBIWINFIN1772764213) ISP Security LLC (Incident ID: FBI1775075315) AT&T (Incident ID: FBIATTVER1772836650) Snowflake (Incident ID: ATT1764635319) Snowflake (Incident ID: ATT3032030111625) Snowflake (Incident ID: ATT0092600102125) Verizon (Incident ID: ATT000011825) Snowflake (Incident ID: ATT1764781901) Snowflake (Incident ID: SNO000110624) Snowflake (Incident ID: ATT0893608111425) Snowflake (Incident ID: ATT1765044347) Snowflake (Incident ID: ATT1803418111425) Snowflake (Incident ID: ATT1764820523)

Does AT&T Business have SOC 2 Type 1 certification ?

According to Rankiteo, AT&T Business is not certified under SOC 2 Type 1.

Does AT&T Business have SOC 2 Type 2 certification ?

According to Rankiteo, AT&T Business does not hold a SOC 2 Type 2 certification.

Does AT&T Business comply with GDPR ?

According to Rankiteo, AT&T Business is not listed as GDPR compliant.

Does AT&T Business have PCI DSS certification ?

According to Rankiteo, AT&T Business does not currently maintain PCI DSS compliance.

Does AT&T Business comply with HIPAA ?

According to Rankiteo, AT&T Business is not compliant with HIPAA regulations.

Does AT&T Business have ISO 27001 certification ?

According to Rankiteo,AT&T Business is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does AT&T Business operate in ?

AT&T Business operates primarily in the Telecommunications industry.

How many employees does AT&T Business have ?

AT&T Business employs approximately 73 people worldwide.

Does AT&T Business own any subsidiaries ?

AT&T Business presently has no subsidiaries across any sectors.

How many LinkedIn followers does AT&T Business have ?

AT&T Business's official LinkedIn profile has approximately 304,787 followers.

What is the NAICS classification code for AT&T Business ?

AT&T Business is classified under the NAICS code 517, which corresponds to Telecommunications.

Does AT&T Business have a Crunchbase profile ?

No, AT&T Business does not have a profile on Crunchbase.

Does AT&T Business have a LinkedIn profile ?

Yes, AT&T Business maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/attbusiness.

How many cybersecurity incidents has AT&T Business experienced ?

As of August 2, 2026, Rankiteo reports that AT&T Business has experienced 33 cybersecurity incidents.

How many peer or competitor companies does AT&T Business have ?

AT&T Business has an estimated 10,260 peer or competitor companies worldwide.

What types of cybersecurity incidents has AT&T Business faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Breach, Ransomware and Cyber Attack.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

AT&T Business

Boost Score +25 with badge (5 left)

756

/1000

Fair

781

/1000

Fair

AT&T Business Vendor Cyber Rating & Cyber Score

att.com

Add Your Compliance Badge

Immerse yourself in the world of digital transformation & how it’s changing the way we do business: https://www.business.att.com/about/why-att-business.html

AT&T Business A.I CyberSecurity Scoring

Scoring History

AT&T Business

AT&T Business CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

AT&T

Breach

100

6/2026

IBM

ATTIBM178116859...

AT&T

Cyber Attack

100

5/2026

OKTMICATTNVI178...

AT&T

Breach

5/2026

METORATICBANYAH...

AT&T

Vulnerability

100

5/2026

Fortinet

MERCHESAMCOMFOX...

AT&T

Breach

100

3/2026

UUNET

LUMATTVERFBIWIN...

AT&T

Cyber Attack

100

3/2026

ISP Security LL...

FBI1775075315

AT&T

Cyber Attack

100

2/2026

AT&T

FBIATTVER177283...

AT&T

Breach

100

2/2026

ATT1770123242

AT&T

Breach

12/2025

Snowflake

ATT1764635319

AT&T

Breach

100

11/2025

Snowflake

ATT303203011162...

AT&T

Breach

5/2025

Snowflake

ATT009260010212...

AT&T

Breach

100

1/2025

Verizon

ATT000011825

AT&T

Breach

100

12/2024

Snowflake

ATT1764781901

AT&T

Breach

100

11/2024

Snowflake

SNO000110624

AT&T Business

Breach

7/2024

ATT439234311132...

AT&T

Breach

6/2024

Snowflake

ATT089360811142...

AT&T

Breach

100

4/2024

Snowflake

ATT1765044347

AT&T

Breach

3/2024

Snowflake

ATT180341811142...

AT&T

Breach

1/2024

Snowflake

ATT1764820523

AT&T Business

Breach

5/2023

ATT252072925

AT&T Business

Breach

100

01/2023

ATT41910723

AT&T Business

Breach

100

10/2022

ATT469204610102...

AT&T Business

Cyber Attack

100

08/2022

ATT2145281022

AT&T Business

Breach

6/2022

ATT406524009062...

AT&T Business

Breach

100

5/2022

ATT520235211132...

AT&T Business

Ransomware

6/2021

ATT219202110242...

AT&T

Breach

1/2020

TICHARATTPRIMCD...

AT&T Business

Breach

100

6/2019

ATT336213310092...

AT&T Business

Breach

6/2015

ATT289222809302...

AT&T Business

Breach

4/2014

ATT444072925

AT&T Business

Breach

2/2014

ATT025072625

AT&T

Breach

1/2013

ADOMETYAHATTTRA...

AT&T

Breach

100

1/2013

ATTIBM178094643...

Loading…

A.I.

AT&T Business Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for AT&T Business

Incidents vs Telecommunications Industry Avg (This Year)

No incidents recorded for AT&T Business in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for AT&T Business in 2026.

Incident Types AT&T Business vs Telecommunications Industry Avg (This Year)

No incidents recorded for AT&T Business in 2026.

Incident History - AT&T Business (X = Date, Y = Severity)

Loading…

SUBSIDIARY

AT&T Business Subsidiaries

AT&T Business

Telecommunications

Website: https://www.business.att.com/learn/home.html

Company Size: 10,001+ employees

AT&TTelecommunications

AT&T Public PolicyPublic Policy Offices

Dream with RainnWellness and Fitness Services

AT&T Partner SolutionsTelecommunications

FirstNet, Built with AT&TTelecommunications

Loading…

AT&T Business Similar Companies

Bouygues Telecom

cb bouyguestelecom.fr

🤝Ce qui fait notre singularité ? Chez Bouygues Telecom, nous croyons que les relations humaines sont un besoin vital. La qualité de nos relations avec notre famille, nos amis, ceux qui nous entourent est déterminante pour notre bien-être, notre santé et même notre espérance de vie. Ce sont ces relations qui nous épanouissent, nous font aller de l’avant et nous permettent de vivre plus heureux, plus longtemps. C’est pourquoi depuis notre création en 1996, les équipes Bouygues Telecom mettent toute leur énergie pour que la technologie soit avant tout au service de vos relations. Nous souhaitons agir pour faire grandir les relations humaines. En permettant à tous sans exception de garder le contact avec ses proches et la société. En devenant une source d’inspiration qui donne à chacun l’envie d’enrichir et d’améliorer la qualité de ses relations. Nos 10 500 collaborateurs relèvent tous ensemble au quotidien ce même défi : être engagés pour un numérique qui nous réunit. 💼 Nos métiers ? Quelles que soient vos aspirations il y aura forcément un métier pour vous chez Bouygues Telecom ! Plus de 150 métiers interagissent tous les jours : Télécom / Réseau, IT, Big Data, Innovation, Marketing, Commerce, Finance, Achats, Juridique… Nous avons besoin de tous les talents pour accomplir notre mission; car c’est cette richesse de profils et de compétences qui fait la qualité de nos services et contribue à la satisfaction de nos clients. 👉Alors si... Vous avez envie de mettre votre talent au service du développement numérique pour tous et de faire grandir les relations humaines : vous frappez à la bonne porte. Vous rêvez d’une entreprise qui donne le meilleur d’elle-même pour que vous puissiez donner le meilleur à votre tour : alors bienvenue ! #OnEstFaitPourEtreEnsemble

Telcel

telcel.com

Telcel (Radiomóvil Dipsa) es subsidiaria de América Móvil, uno de los mayores proveedores de comunicaciones celulares de Latinoamérica, grupo líder con inversiones en telecomunicaciones en varios países del continente americano. Telcel es la empresa de telefonía celular líder en México. Nuestra solidez y estructura nos consolidan gracias a la especialización y actualización permanente de todas las personas que trabajamos en ella. Todos nosotros estamos comprometidos a satisfacer de manera eficaz y constante todas las necesidades de comunicación inalámbrica de nuestros clientes.

TIM Brasil

tim.com.br

A TIM é a empresa de telefonia móvel que mais cresce no Brasil. Atualmente, possui mais de 13 mil colaboradores em todo o país que trabalham entregando serviços inovadores e de qualidade em telefonia móvel, fixa e internet banda larga. É uma companhia feita de pessoas criativas, com energia realizadora e foco no cliente. Transparência, qualidade e inovação para que os consumidores brasileiros possam fazer cada vez mais e ir mais longe. Conheça as oportunidades na aba de Carreiras!

A1 Telekom Austria Group

a1.group

WE ARE EMPOWERING DIGITAL LIFE We don't know what the world will look like in 2050, but we know that A1 Telekom Austria Group is geared up for current and future demands. We are a leading provider of digital services and communications solutions in Central and Eastern Europe, offering a state-of-the art network infrastructure as well as empowering digitalization. 19.000 of our employees and modern broadband infrastructure make digital business and lifestyle possible as well as enable more than 24 mio users to connect everywhere anytime. Our purpose is to Empower Digital Life in areas of communications, payment, entertainment services and integrated business solutions. We do this together with our operating companies in 7 European countries: Austria, Bulgaria, Croatia, Slovenia, Belarus, Republic of Serbia and Republic of North Macedonia. Headquartered in Vienna and listed on the Vienna Stock Exchange, the A1 Telekom Austria Group is an European unit of América Móvil, one of the world´s largest wireless services providers. You can also follow us here: https://twitter.com/TA_Group Find out more about us as an employer on https://jobs.a1.com/

stc

stc.com.sa

We are a forward-focused digital champion always been focused on innovation and evolution. Our purpose is to create and bring greater dimension and richness to people’s personal and professional lives. With stc, You will always be empowered to focus on delivering what’s next through collaborative and agile ways of working, and a culture that is open to fresh ideas. Transforming the future through impactful digital solutions and mega-projects while fostering our commitment to sustainability. Join a people-centric environment; that cares about maximizing your wellbeing, and is committed to unlocking your potential.

Jazz

jazz.com.pk

Pakistan’s number one digital operator and the largest internet and broadband service provider with over 70 million subscribers nationwide. With a legacy of more than 27 years, Jazz maintains market leadership through cutting-edge, integrated technology, the strongest brands and the largest portfolio of value added services in the industry. Housing a nation-wide network of contact centers and an unparalleled fibre optic backbone of more than 25,000 kilometers, Jazz has already invested billions of dollars in the country to date. It also provides uninterrupted countrywide connectivity, unmatched customer services and international roaming in over 150 countries. As a responsible entity, the company passionately supports education, health and environmental initiatives and promotes sustainable business practices. Jazz offers exclusive & personalized tariff plans that empower customers and cater to the communication needs of a diverse group of people, from individuals to businessmen to corporate and multinationals. Through its innovative services and products, Jazz is set to bring about a digital revolution that will enable and transform societies towards a more progressive Pakistan.

Spectrum

spectrum.com

Spectrum is a suite of advanced communications services offered by Charter Communications, Inc. (NASDAQ:CHTR), a leading broadband connectivity company available to more than 57 million homes and small to large businesses across 41 states. Founded in 1993, Charter has evolved from providing cable TV to streaming, and from high-speed Internet to a converged broadband, WiFi and mobile experience. Over the Spectrum Fiber Broadband Network and supported by our 100% U.S.-based employees, the Company offers Seamless Connectivity and Entertainment with Spectrum Internet®, Mobile, TV and Voice products. More information can be found at corporate.charter.com.

Claro Brasil

claro.com.br

Prazer, somos a Claro! Aqui, temos um grande time que faz tudo acontecer! É com o esforço e a dedicação de cada uma de nossas Pessoas que somos hoje referência no que fazemos, atuando unidos no nosso propósito, que é “Conectar para uma vida mais divertida e produtiva”. Somamos todas as tecnologias para criar a melhor e mais completa infraestrutura de conectividade do País. Somos multicampeões confirmado pelo Speedtest como Internet móvel mais rápida e estável e com rede wi-fi mais estável do Brasil, entre tantos outros reconhecimentos. Também somos a 4º marca mais valiosa do Brasil (BrandZ). No Brasil, estamos presentes em mais de 4.800 municípios, somando mais de 83 milhões de clientes. Lideramos o saldo de portabilidade há mais de 5 anos, sendo que, em 2022, tivemos 1,2 milhão de linhas portadas. E tem mais: inovamos nossos produtos e serviços para atender cada vez melhor nossos usuários! Por isso, hoje, contamos com soluções de entretenimento (Claro música, Claro tv+, Claro livros, Claro vídeo e Claro gaming), finanças (Claro pay) e muito mais! Temos presença aeroespacial (com 5 satélites em órbita) e somos referência em conectividade industrial, automotiva, agronegócio e outros. Também temos um ambiente de conexão entre nossos negócios e o ecossistema de inovação, que é o beOn, o hub de inovação da Claro. Sustentabilidade é um valor para a Claro. Investimos no desenvolvimento ambiental, econômico e social, prezando sempre pela governança, responsabilidade ambiental, proteção de dados e impacto social. Por meio do Instituto Claro, conectamos pessoas para um futuro melhor, aliando os serviços prestados a investimentos sociais em projetos de educação e cidadania. #VempraClaro

e& Egypt

eand.com.eg

Building on 17 years of technology excellence in the Egyptian market, and in our relentless quest to bring you more and better services, etisalat by e& in Egypt has now evolved into the digital telco of the future. Covering and serving 99% of the inhabited areas in Egypt, our mission as etisalat by e& in Egypt is to continuously grow and transform to empower our customers by enhancing their digital experience and ensuring operation agility. etisalat by e& in Egypt offers digital experiences that cater to your ever-changing lifestyle and ever-expanding demands – covering not only telecom, but a wide collection of services that suit your various needs. We will continue to be your trusted companion and consultant, enabling connectivity and everything beyond, accelerating the digital world and pioneering future-forward spaces. Together, as we embark on this new era of etisalat by e& in Egypt, we make possible countless connections across continents and create the limitless possibilities of tomorrow, today. etisalat by e& in Egypt #MakePossible بعد ١٥ سنة من تفوقنا التكنولوجي في مصر، ولإننا حابين نقدم خدمات كتيرة عالية الجودة لكل عملائنا، جه الوقت إللي نطور في “اتصالات من &e في مصر” وندخل المستقبل الرقمي من أوسع الأبواب! شبكتنا النهاردة بتغطي ۹۹% من مناطق مصر، وبنطور يوم ورا يوم عشان نوصل رسالتنا بالنمو والتحول والتفوق، كل دا عشان نوفر لعملائنا أفضل تجربة رقمية، ونسرع العملية التشغيلية. النهاردة في “اتصالات من &e في مصر” إحنا جاهزين نقدملكم خدمات رقمية جديدة تسهلكو حياتكم اليومية، ومع خدمة المكالمات التقليدية، حنوفرلكم خدمات تانية كتير! لإننا بجد شريكم الموثوق، إللي بيخليكم على تواصل، وبياخدكم للمستقبل عبر تسريع الاقتصاد الرقمي والريادة. مع “اتصالات من &e في مصر” حنبدأ مع بعض عصر جديد، ونقربكم من بعض عبر القارات، ومع بعض حنكتشف إمكانيات بكرة اللامحدودة من النهاردة. “اتصالات من &e في مصر” ... معانا #makepossible

Loading…

NEWS

AT&T Business CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

April 05, 2026 05:46 AM

Carey and Christensen Continue Outdoor Seasons at Sam Howell Invitational

PRINCETON, N.J.—First year women's throwers Jane Carey (Webster, N.Y.) and Kiera Christensen (Alexandria, Minn.)

Read Article

April 05, 2026 05:43 AM

Baseball's Bats Come Alive in Series Finale at San Diego

The Santa Clara University baseball team rekindled its offense Saturday, but host San Diego's bats didn't cool off, as the teams combined...

Read Article

April 05, 2026 05:31 AM

Tigers Conclude Weekend with Loss at San Diego

The men's tennis program suffered a 4-0 setback against San Diego on Saturday afternoon, concluding the first half of a four-match road...

Read Article

April 05, 2026 05:24 AM

Frogs Wrap Up Weekend at Texas Relays

AUSTIN – After bracing the rain, TCU track and field wrapped up a successful weekend at the 98 th Clyde Littlefield Texas Relays on Saturday...

Read Article

April 05, 2026 05:23 AM

Elon Drops Road Test At Liberty

LYNCHBURG, Va. – The Elon men's tennis team (5-12) won a pair of singles matches Saturday at No. 69 Liberty (11-9) but fell 5-2 to the...

Read Article

April 05, 2026 05:23 AM

Elon Places Sixth At Carolina Challenge Cup

CHAPEL HILL – The Elon women's golf team competed in the North Carolina Challenge Cup on Saturday at Finley Golf Club, finishing sixth in a...

Read Article

April 05, 2026 05:23 AM

Phoenix Falls At Old Dominion

The Elon women's tennis team (12-4) dropped a match to No. 63 Old Dominion (7-4) on Saturday, falling 4-1 to the Monarchs at the...

Read Article

April 05, 2026 05:04 AM

Bulldogs Post Multiple Top-10 Finishes at NSU Invitational

NORFOLK, VA — The Bowie State men's and women's track and field teams posted a series of strong performances at the NSU Invitational,...

Read Article

April 05, 2026 04:55 AM

Tigers Showcase Team Depth With Strong Performance at Sam Howell

PRINCETON, N.J. – Winning 10 events across all event groups, the Princeton women's and field dominated as it hosted the Sam Howell...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…