What is the official website of AXA Hong Kong and Macau ?

The official website of AXA Hong Kong and Macau is https://www.axa.com.hk/en.

What is AXA Hong Kong and Macau's cybersecurity risk score?

AXA Hong Kong and Macau has an AI-generated cybersecurity risk score of 757 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has AXA Hong Kong and Macau experienced?

According to Rankiteo, AXA Hong Kong and Macau currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has AXA Hong Kong and Macau been affected by any supply chain cyber incidents ?

According to Rankiteo, AXA Hong Kong and Macau has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.

Does AXA Hong Kong and Macau have SOC 2 Type 1 certification ?

According to Rankiteo, AXA Hong Kong and Macau is not certified under SOC 2 Type 1.

Does AXA Hong Kong and Macau have SOC 2 Type 2 certification ?

According to Rankiteo, AXA Hong Kong and Macau does not hold a SOC 2 Type 2 certification.

Does AXA Hong Kong and Macau comply with GDPR ?

According to Rankiteo, AXA Hong Kong and Macau is not listed as GDPR compliant.

Does AXA Hong Kong and Macau have PCI DSS certification ?

According to Rankiteo, AXA Hong Kong and Macau does not currently maintain PCI DSS compliance.

Does AXA Hong Kong and Macau comply with HIPAA ?

According to Rankiteo, AXA Hong Kong and Macau is not compliant with HIPAA regulations.

Does AXA Hong Kong and Macau have ISO 27001 certification ?

According to Rankiteo,AXA Hong Kong and Macau is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does AXA Hong Kong and Macau operate in ?

AXA Hong Kong and Macau operates primarily in the Insurance industry.

How many employees does AXA Hong Kong and Macau have ?

AXA Hong Kong and Macau employs approximately 887 people worldwide.

Does AXA Hong Kong and Macau own any subsidiaries ?

AXA Hong Kong and Macau presently has no subsidiaries across any sectors.

How many LinkedIn followers does AXA Hong Kong and Macau have ?

AXA Hong Kong and Macau's official LinkedIn profile has approximately 37,634 followers.

What is the NAICS classification code for AXA Hong Kong and Macau ?

AXA Hong Kong and Macau is classified under the NAICS code 524, which corresponds to Insurance Carriers and Related Activities.

Does AXA Hong Kong and Macau have a Crunchbase profile ?

No, AXA Hong Kong and Macau does not have a profile on Crunchbase.

Does AXA Hong Kong and Macau have a LinkedIn profile ?

Yes, AXA Hong Kong and Macau maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/axahongkong.

How many cybersecurity incidents has AXA Hong Kong and Macau experienced ?

As of August 2, 2026, Rankiteo reports that AXA Hong Kong and Macau has experienced 1 cybersecurity incidents.

How many peer or competitor companies does AXA Hong Kong and Macau have ?

AXA Hong Kong and Macau has an estimated 15,653 peer or competitor companies worldwide.

What types of cybersecurity incidents has AXA Hong Kong and Macau faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Ransomware.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

AHKM

Boost Score +25 with badge (5 left)

757

/1000

Fair

782

/1000

Fair

AXA Hong Kong and Macau Vendor Cyber Rating & Cyber Score

axa.com.hk

Add Your Compliance Badge

AXA Hong Kong and Macau is a member of the AXA Group, a leading global insurer with presence in 50 markets and serving 95 million customers worldwide. Our purpose is to act for human progress by protecting what matters. As one of the most diversified insurers in Hong Kong, we offer integrated solutions across Life, Health and General Insurance. We are the largest General Insurance provider and a major Health and Employee Benefits provider. Our aim is to not only be the insurer to provide comprehensive protection to our customers, but also a holistic partner to the individuals, businesses and community we serve. At the core of our service commitment is continuous product & service innovation and customer experience enrichment, which is

AHKM A.I CyberSecurity Scoring

Scoring History

AHKM

AXA Hong Kong and Macau CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

AXA Hong Kong and M...

Ransomware

5/2021

AXA12312222

Loading…

A.I.

AHKM Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for AHKM

Incidents vs Insurance Industry Avg (This Year)

No incidents recorded for AXA Hong Kong and Macau in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for AXA Hong Kong and Macau in 2026.

Incident Types AHKM vs Insurance Industry Avg (This Year)

No incidents recorded for AXA Hong Kong and Macau in 2026.

Incident History - AHKM (X = Date, Y = Severity)

Loading…

SUBSIDIARY

AXA Hong Kong and Macau Subsidiaries

AHKM

Insurance

Website: https://www.axa.com.hk/en

Company Size: 1,001-5,000 employees

AXAInsurance

AXA en FranceInsurance

AXA XLInsurance

AXA GulfInsurance

AXA Investment ManagersFinancial Services

GIG SaudiInsurance

AXA PartnersInsurance

AXA Partners FranceInsurance

AXA Partners BeneluxInsurance

AXA Partners ColombiaInsurance

AXA Partners UK & IrelandInsurance

AXA Partners BeneluxInsurance

AXA Partners ItaliaInsurance

AXA Partners USInsurance

AXA Partners GermanyInsurance

AXA Partners Central & Eastern EuropeInsurance

AXA Partners Asia, Middle-East, Turkey & AfricaInsurance

Bharti AXA Life InsuranceInsurance

AXA WealthFinancial Services

AXA UKFinancial Services

AXA Group OperationsIT Services and IT Consulting

AXA ItaliaInsurance

AXA Global HealthcareInsurance

AXA HealthFinancial Services

AXA Corporate SolutionsInsurance

AXA Global ReInsurance

AXA Global DirectInsurance

Direct AssuranceInsurance

UNIQA PolskaInsurance

DIRECT SEGUROSInsurance

QUIXAInsurance

AXA JapanInsurance

AXA KoreaInsurance

Touring Assurances / Touring Verzekeringen (TATV)Insurance

AXA MPS Financial DACFinancial Services

AXA MPSInsurance

AXA von Herz zu Herz e.V.Civic and Social Organizations

AXA Life EuropeFinancial Services

AXA Research FundResearch Services

AXA Liabilities ManagersInsurance

AXA Minmetals AssuranceInsurance

Loading…

AXA Hong Kong and Macau Similar Companies

中国人民保险 PICC

picc.com

Founded in October 1949, The People’s Insurance Company (Group) of China is the first nation-wide insurance company in the People’s Republic of China and has developed into a leading large-scale integrated insurance financial group in the PRC, ranking 208th on the Global 500 (2014) published by the Fortune magazine. The Company is an investment holding company. The Company operates its property and casualty insurance business through PICC Property and Casualty Company.The Company operates its life and health insurance businesses through PICC Life Insurance Company and PICC Health Insurance Company , The Company centrally and professionally manages most of its insurance assets through PICC Asset Management Company and PICC Investment Holding which is a professional investment company specializing in real estate investments. The Company also carries out non-transactional businesses such as equity and debt investments in insurance and non-insurance capital within and outside the Group through PICC Capital Investment Management Company.The Company has also made strategic investments in non-insurance financial businesses such as banking and trust.

Farmers Insurance

cb farmers.com

The companies comprising the Farmers Insurance Group of Companies® currently make up one of the country's largest insurers of vehicles, homes and small businesses, and provide a wide range of other specialty insurance and financial services products. In business since 1928, today at Farmers® we proudly serve millions of households across all 50 states through an extensive network of exclusive and independent agents and approximately 18,000 employees. Our experience provides a rich history and legacy of service and strong customer relationships, while our focus on smart innovation, technology and entrepreneurship helps us to stay creative, to continually improve our product offerings and to drive the evolution of the insurance industry. Every interaction with our customers is a chance to stand out through personalized service and make a meaningful difference in their lives. We take pride in empowering individuals and businesses to become smarter and better prepared to protect what matters most. Giving back is also a core part of who we are. Our culture is rooted in volunteerism and a shared commitment to strengthening the communities where we live and work. At Farmers, we truly value your experience as a candidate, and part of that is helping you stay informed and protected. Please keep in mind that any email from a legitimate corporate Farmers Insurance employee will always come from an email address ending in @farmersinsurance.com, @bristolwest.com, or @foremost.com. If you see a message from a different domain, even one that looks close, it's best to treat it with caution. Knowing this helps ensure your communication with us stays safe, secure, and authentic. And if you are ever suspicious of an email and want to verify the legitimacy, please feel free to send an email to [email protected]

Aditya Birla Sun Life Insurance

adityabirlacapital.com

Established in 2000, Aditya Birla Sun Life Insurance Company Limited (formerly Birla Sun Life Insurance Company Limited) is a joint venture between the Aditya Birla Group, a well known and trusted name globally amongst Indian conglomerates and Sun Life Financial Inc, leading international financial services organization from Canada. The local knowledge of the Aditya Birla Group combined with the domain expertise of Sun Life Financial Inc., offers a formidable protection for its customers' future. With an experience of over 10 years, ABSLI has contributed significantly to the growth and development of the life insurance industry in India and currently ranks amongst the top 7 private life insurance companies in the country. Known for its innovation and creating industry benchmarks, ABSLI has several firsts to its credit.It was the first Indian Insurance Company to introduce "Free Look Period" and the same was made mandatory by IRDA for all other life insurance companies. Additionally, ABSLI pioneered the launch of Unit Linked Life Insurance plans amongst the private players in India. To establish credibility and further transparency, ABSLI also enjoys the prestige to be the originator of practice to disclose portfolio on monthly basis. These category development initiatives have helped ABSLI be closer to its policy holders expectations, which gets further accentuated by the complete bouquet of insurance products (viz. pure term plan, life stage products, health plan and retirement plan) that the company offers.

Manulife

cb manulife.com

Manulife is a leading international financial services group that helps people make their decisions easier and lives better. With our global headquarters in Toronto, we operate as Manulife across our offices in Canada, Asia, and Europe, and primarily as John Hancock in the United States. We have more than 40,000 employees, over 116,000 agents serving ~34 million customers worldwide, and over $1.3 trillion in assets under management and administration. Visit www.Manulife.com to find out more. For Manulife terms of use, please visit http://bit.ly/SM_Terms

Progressive Insurance

cb progressive.com

Every journey has a beginning, and wherever you are on your career path, we want to help you along the way. At Progressive, we exist to help people move forward and live fully. We strive to create a welcoming and flexible work environment for everyone, where employees are encouraged to risk, learn, and grow. With our supportive culture, work-life balance, and one of the largest contemporary art collections in the country, there’s a reason we’ve been named one of the best places to work. For over 80 years, Progressive has offered customers a wide range of insurance choices, including auto, home, renters, commercial auto, small business, motorcycle, boat policies, and more. Progressive is the second largest auto insurer in the country—a combined effort of every single person at Progressive. We’re a dynamic group of more than 65,000 talented employees—from all walks of life, all fields of business, and all 50 states. Everyone here plays a role in our success as we continue to help our customers move forward and live fully. With hundreds of career paths including Claims, Customer Care, Sales, Marketing, Legal, IT, Data Analysis, and more, you are sure to find the destination for your career at Progressive.

Groupama

cb groupama-gan-recrute.com

« Etre là pour les autres, j'ai décidé d'en faire mon métier. » Portée par nos 32 000 collaborateurs, notre campagne de communication employeur souligne ce qui nous rassemble et nous rend fiers au quotidien : notre métier, le point de départ de belles histoires, humaines avant tout. Cette campagne met l’accent sur ce qui nous différencie de nos concurrents : notre ADN mutualiste. Au sein du Groupe Groupama, l’humain et le sens sont privilégiés. Nous recrutons des personnes et pas des diplômes, de belles personnalités qui seront demain au service de nos sociétaires et clients. La signature de cette campagne « Etre là pour les autres, j’ai décidé d’en faire mon métier » résonne avec notre raison d’être « Nous sommes là pour permettre au plus grand nombre de construire leur vie en confiance. » et notre positionnement de marque. Etre là pour les autres, c'est le point de départ de notre métier. Et c'est aussi le point de départ de belles histoires qui font notre Groupe et notre identité en tant qu'employeur. Des histoires vraies pleines d'humanité. Nos collaborateurs en ont plein à raconter ! Découvrez leurs belles histoires sur www.groupama-gan-recrute.com ! Vous aussi, vous voulez donner du sens à vos compétences ? Rejoignez nous ! Et sinon, le Groupe Groupama c'est plus de 50 entreprises dans 10 pays. Vous nous connaissez au travers de nos 2 marques commerciales Groupama et Gan. Nous accompagnons nos 12 millions de sociétaires et clients à chaque moment de leur vie grâce à nos experts et à notre savoir-faire.

TATA AIG General Insurance Company Limited

tataaig.com

At TATA AIG General Insurance, we wear our achievements like a badge of honour – proudly and with gratitude! We have been recognized as one of India’s Top 100 Best Companies to Work For and among the Top 25 Best Workplaces in BFSI in 2024. As a joint venture between the TATA Group and American International Group (AIG), we bring together the best of both worlds, driving innovation and setting new standards in the insurance industry, while staying true to our core values of empathy, people, and customer-first that translates into: #WithYouAlways and #WithYouLikeFamily. This means we’re committed not only to our customers but also to our employees, peers, and partners — ensuring the highest level of dedication, care, and trust. Join us on this incredible journey as we continue to lead, innovate, and redefine the future of insurance. Together, we’re not just setting the standard — we’re building lasting relationships, one person at a time.

Lockton

lockton.com

What makes Lockton stand apart is also what makes us better: independence. Our private ownership empowers our 13,100+ Associates doing business in over 140+ countries to focus solely on clients' risk and insurance needs. With expertise that reaches around the globe, we deliver the deep understanding needed to accomplish remarkable results.

Nationwide

nationwide.com

Nationwide, a Fortune 100 company based in Columbus, Ohio, is one of the largest and strongest diversified insurance and financial services organizations in the United States. Nationwide is rated A+ by Standard & Poor's. An industry leader in driving customer-focused innovation, Nationwide provides a full range of insurance and financial services products including auto, business, homeowners, farm and life insurance; public and private sector retirement plans, annuities and mutual funds; excess & surplus, specialty and surety; and pet, motorcycle and boat insurance. For more information, visit www.nationwide.com.

Loading…

NEWS

AXA Hong Kong and Macau CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

February 06, 2026 08:00 AM

AXA And Deloitte Private Target Stickier High Net Worth Relationships

AXA Hong Kong and Macau and Deloitte Private have entered into a collaboration to expand wealth management support for high-net-worth...

Read Article

February 05, 2026 08:00 AM

AXA and Deloitte Private Forge Strategic Initiative To Enhance Wealth Planning for HNW Clients

AXA Hong Kong and Macau ("AXA") is pleased to announce its strategic initiative with Deloitte Private, to elevate its wealth management...

Read Article

January 29, 2026 08:00 AM

AXA Introduces Quest by AXA

An Industry Pioneering AI-Powered Advisor Platform. HONG KONG, Jan. 30, 2026 /PRNewswire/ -- AXA Hong Kong and Macau ("AXA") today announced...

Read Article

January 27, 2026 08:00 AM

AXA completes re-domiciliation of China insurance unit to Hong Kong

AXA Hong Kong and Macau has finalised the re-domiciliation of its China-focused insurance holding company from Bermuda to Hong Kong.

Read Article

October 27, 2025 07:00 AM

“Exposure Can Be Valued If Bought Outright”: iFX EXPO Asia 2025 Kicks Off in Hong Kong

iFX EXPO Asia 2025 opened in Hong Kong this weekend, marking the event's return to one of Asia's key financial centers.

Read Article

October 27, 2025 07:00 AM

“Exposure Can Be Valued If Bought Outright”: iFX EXPO Asia 2025 Kicks Off in Hong Kong

iFX EXPO Asia 2025 opened in Hong Kong, gathering brokers, fintech firms, and over 4000 participants for conferences and exhibitions.

Read Article

October 24, 2025 07:00 AM

AXA Garners Seven Awards at The Hong Kong Insurance Awards 2025

AXA Hong Kong and Macau ("AXA") received seven accolades at The Hong Kong Insurance Awards 2025, including three winners and four top 3.

Read Article

September 05, 2025 07:00 AM

Outstanding tech companies, innovations lauded at Hong Kong Business Technology Excellence Awards 2025

The awards programme shone a spotlight on groundbreaking technological achievements across industries in Hong Kong. Hong Kong's dynamic tech...

Read Article

June 24, 2025 07:00 AM

AXA celebrates remarkable achievement with 9 accolades, including two Insurance Company of the Year at the Bloomberg Businessweek Financial Institutions Awards 2025

AXA Hong Kong and Macau ("AXA") is delighted to announce its outstanding recognition at the Bloomberg Businessweek Financial Institutions...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…