Incorrect Authorization vulnerability in ash-project ashphoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.

AshPhoenix.LiveView.SubdomainHook.onmount/4 attached a handleparams hook to assign the tenant and then immediately called handlesubdomain in the same onmount. The tenant assign is only written when LiveView later runs handleparams, strictly after onmount returns, so handlesubdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handlesubdomain inside the handleparams hook with the real tenant on every navigation.

This issue affects ashphoenix: from 2.1.26 before 2.3.25.