Read the docs
TI-2026-36668 Aliases CVE-2026-49757GHSA-777c-2fxx-qr28

OAuth2/OIDC account takeover in AshAuthentication via email-based user matching

Priority HIGH 81CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-290.

Summary

Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address (an upsert on the email field, or a user-defined sign-in filter) rather than by the OpenID Connect iss/sub claim combination. Per OpenID Connect Core §5.7, only iss/sub uniquely and stably identifies an end-user; other claims, including email, MUST NOT be used as unique identifiers. A provider login presenting a victim's email, including an unverified email, a reused email, or an account with email_verified: false, resolved to and signed in as the victim's existing local account. An unauthenticated attacker who can register an account on any accepted OAuth provider with the victim's email (or who benefits from provider-side email reuse or reclamation) obtains the victim's full local privileges. The fix resolves users by the (strategy, sub) identity stored in a user identity resource, and only links a new sub to an existing local account by email when the provider's email_verified claim is trusted (trust_email_verified?). This issue affects ash_authentication from 0.1.0 before 4.14.0 and from 5.0.0-rc.0 before 5.0.0-rc.10.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00615 49th percentileScored 2026-11-07
Fix Fixed ash_authentication (team-alembic): 4.14.0, 5.0.0-rc.10ash_authentication (Hex): 4.14.0, 5.0.0-rc.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
team-alembicash_authentication0.1.0 to before 4.14.0; 5.0.0-rc.0 to before 5.0.0-rc.104.14.0, 5.0.0-rc.10Patch availableCNA
—ash_authentication (Hex)0.1.0 to before 4.14.04.14.0Patch availableGHSA-777c-2fxx-qr28
—ash_authentication (Hex)5.0.0-rc.0 to before 5.0.0-rc.105.0.0-rc.10Patch availableGHSA-777c-2fxx-qr28
  • ash_authentication Vendorteam-alembic Affected 0.1.0 to before 4.14.0; 5.0.0-rc.0 to before 5.0.0-rc.10 Fixed in 4.14.0, 5.0.0-rc.10 Patch available CNA
  • ash_authentication (Hex) Vendor— Affected 0.1.0 to before 4.14.0 Fixed in 4.14.0 Patch available GHSA-777c-2fxx-qr28
  • ash_authentication (Hex) Vendor— Affected 5.0.0-rc.0 to before 5.0.0-rc.10 Fixed in 5.0.0-rc.10 Patch available GHSA-777c-2fxx-qr28

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA ash_authentication (team-alembic) Fixed in 4.14.0, 5.0.0-rc.10
  • Fix · GHSA-777c-2fxx-qr28 ash_authentication (Hex) Fixed in 4.14.0 Advisory →
  • Fix · GHSA-777c-2fxx-qr28 ash_authentication (Hex) Fixed in 5.0.0-rc.10 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49757
  2. 2026-10-03 Alias added: GHSA-777c-2fxx-qr28
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 2

Advisory 2

Other 5

  • TI-2026-46782 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication CVSS 4.0HIGH 7.6
  • TI-2026-59214 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix CVSS 4.0CRITICAL 9.1
  • TI-2026-58664 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication CVSS 4.0CRITICAL 9.1
  • TI-2026-53751 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement CVSS 4.0CRITICAL 9.1
  • TI-2026-57079 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication CVSS 4.0CRITICAL 9.1
  • TI-2026-47468 Reflected XSS in AshAuthentication confirmation and magic link interaction forms CVSS 4.0LOW 2.1
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences