CVE-2026-2906

Vulnerability in ash_authentication related to dynamic_oidc strategy that fails to maintain proper identity namespace separation across connections. An attacker controlling one connection can be signed in as a local user created through a different connection because user identities are not correctly separated.

In pgAdmin 4, the 'webserver' authentication source was vulnerable because WebserverAuthentication.get_user() fell back to reading the username directly from inbound HTTP request headers when the WSGI/CGI environment lookup returned nothing. As a result, any client able to reach pgAdmin could supply that header itself and authenticate as any username, including an existing Administrator, without a password. The issue affects versions from 6.2 before 9.18 and only applies when 'webserver' is enabled in AUTHENTICATION_SOURCES.

In ash_authentication there is an improper authentication vulnerability that allows an attacker to sign in as another user by linking their OAuth2 identity to an account that is not theirs. The attacker can attach a verified email to an account matched on other attributes, leading to session hijacking.

In CakePHP, the FunctionsBuilder methods (cast, extract, datePart, dateAdd) allow SQL injection by improperly handling user-controlled input. Untrusted data is incorporated into SQL syntax without proper escaping, potentially enabling attackers to execute arbitrary queries.

In Vendure, the createCustomerAndUser function in external authentication matches an existing customer by email address and attaches a new external authentication method without requiring verification. An attacker can use an unverified email to hijack the victim's account.

In vm2 before 3.11.6, the builtin: ['*'] configuration does not restrict access to os and dns builtins, allowing sandbox code to read host process identity and network topology. Attackers can use dns.setServers() to hijack the host process's DNS resolver globally.

In vm2 up to 3.11.6, NodeVM's require policy does not properly normalize node:-prefixed builtin specifiers, allowing bypass of denial lists. Sandbox code can access child_process module, enabling command execution on the host.

In vm2 versions 3.10.1 through 3.11.6, there is a sandbox escape via WebAssembly.compileStreaming and instantiateStreaming, allowing attackers to access the host process object on Node.js 26, leading to full host control.

In vm2 before 3.11.8, there is a sandbox escape vulnerability via console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and execute code on the host process, bypassing code generation restrictions.

In vm2 versions from 3.11.0 before 3.11.8, host TypedArray and ArrayBuffer prototypes are not protected from sandbox mutation. Attackers can modify prototypes, affecting host-created typed arrays and potentially leading to unauthorized actions.