TI-2026-57017 Aliases CVE-2026-82685

Confirmation token accepted on any record in AshAuthentication

LOW 36CWE-639Published 2026-09-17 · Updated 2026-09-17

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record. AshAuthentication.AddOn.Confirmation.ConfirmChange verifies the token's signature and its act claim, then applies the changes stored against that token to whichever record the changeset targets, never comparing the sub claim against changeset.data. An attacker who registers an account and changes their own email replays the resulting token against a victim's record id, writing in their own address with force_change_attributes/2 and stamping confirmed_at, after which an ordinary password reset yields the account. The library's own confirmation flow is unaffected, because AshAuthentication.AddOn.Confirmation.Actions.confirm/3 resolves sub to a user and targets that record. This issue affects ash_authentication: from 0.5.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00665 52nd percentileScored 2026-11-07

Fix Fixed ash_authentication (team-alembic): 4.15.0, 5.0.0-rc.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
team-alembic	ash_authentication	0.5.0 to before 4.15.0; 5.0.0-rc.0 to before 5.0.0-rc.14	4.15.0, 5.0.0-rc.14	Patch available	CNA

ash_authentication Vendorteam-alembic Affected 0.5.0 to before 4.15.0; 5.0.0-rc.0 to before 5.0.0-rc.14 Fixed in 4.15.0, 5.0.0-rc.14 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:team-alembic:ash_authentication::::::::	—	—	—

cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA ash_authentication (team-alembic) Fixed in 4.15.0, 5.0.0-rc.14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-17
team-alembic ash_authentication 4.15.0, 5.0.0-rc.14
14 records Highest priority Priority MEDIUM 5 MEDIUM, 9 LOW
Other records, highest priority first
- TI-2026-59214 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication PhoenixPriority MEDIUM 49
- TI-2026-58664 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthenticationPriority MEDIUM 49
- TI-2026-53751 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacementPriority MEDIUM 49
Show all 14 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-82685
2026-10-04 EPSS moved to the 50th–90th percentile

References

Patch 2

Advisory 1

https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-g636-26vf-2w63

Other 3

TI-2026-36668 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching CVSS 4.0CRITICAL 9.2
TI-2026-46782 Purpose-limited JWT accepted as full bearer authentication in AshAuthentication CVSS 4.0HIGH 7.6
TI-2026-59214 Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix CVSS 4.0CRITICAL 9.1
TI-2026-58664 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication CVSS 4.0CRITICAL 9.1
TI-2026-53751 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement CVSS 4.0CRITICAL 9.1
TI-2026-57079 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication CVSS 4.0CRITICAL 9.1

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences