Read the docs
TI-2026-83456 Aliases CVE-2026-117656

Assent Apple callback lets unverified user parameter override ID token claims

Priority MEDIUM 47CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

Assent's Sign in with Apple strategy merges the user form parameter over the claims of the verified ID token. Apple posts that parameter to the callback, where the browser submits it and the client controls it; Assent.Strategy.Apple.callback/2 decodes it, and fetch_user/2 lets its unverified values win. An unauthenticated remote attacker who completes a Sign in with Apple login with their own Apple ID can replace sub, email and other claims to impersonate another user, which affects applications that look up, link or authorize accounts by subject or email. Affected: assent from 0.1.25 before 0.3.2 (CWE-290, CWE-349; CVSS 4.0 base score 9.3, CRITICAL).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the callback endpoint in a user form parameter that the browser submits and the client controls. Assent.Strategy.Apple.callback/2 in lib/assent/strategies/apple.ex decodes that parameter, and fetch_user/2 merges it over the claims of the verified ID token, so the unverified map wins. An attacker who completes a Sign in with Apple login with their own Apple ID and edits the user parameter can replace sub, email, and any other claim. Applications that look up, link, or authorize accounts by the returned subject or email then act on the attacker's values. This issue affects assent: from 0.1.25 before 0.3.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00228 13th percentileScored 2026-11-07
Fix Fixed assent (pow-auth): 0.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pow-authassent0.1.25 to before 0.3.20.3.2Patch availableCNA
  • assent Vendorpow-auth Affected 0.1.25 to before 0.3.2 Fixed in 0.3.2 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:pow-auth:assent:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:pow-auth:assent:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Upgrade assent to 0.3.2, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA assent (pow-auth) Fixed in 0.3.2

Timeline

  1. 2026-10-31 Threatist record created from CVE-2026-117656
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-06 CISA SSVC decision points changed
  4. 2026-11-06 Priority changed: LOW → MEDIUM

References

Patch 1

Advisory 1

Other 3

  • TI-2019-12545 PowAssent is susceptible to denial of service attacks CVSS 3.1MEDIUM 6.5
  • TI-2023-22611 Pow Mnesia cache doesn't invalidate all expired keys on startup CVSS 3.1MEDIUM 6.5
  • TI-2020-04261 Session fixation attack in Pow (Hex package) CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences