CVE-2026-88952
CriticalCVSS 9.1Summary
In ash_authentication there is an improper authentication vulnerability that allows an attacker to sign in as another user by linking their OAuth2 identity to an account that is not theirs. The attacker can attach a verified email to an account matched on other attributes, leading to session hijacking.
Risk Assessment
Risk of account takeover by an attacker, potentially leading to unauthorized data access and actions on behalf of the victim.
Recommendation
Update ash_authentication to a fixed version (4.15.0 or later for 4.x series and 5.0.0-rc.14 or later for 5.x) to resolve the issue.
Other vulnerabilities in ash_authentication
Original NVD description (English source)
Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action's upsert_identity keys, then gates linking the incoming provider identity to it on email_trusted?/2, which reads only the provider's email_verified boolean and never compares the provider's email value with the matched account's email. That gate assumes the account was matched by its email field, so under any other upsert_identity it is vacuous and an attacker presenting their own verified email is attached to, and issued a session for, an account matched on some other attribute. The same unguarded gate applies in OAuth2.SignInPreparation on the registration_enabled? false path, where the account is matched by the sign-in action's read filter instead. The upsert also rewrites the matched account's email to the attacker's address, so later account recovery reaches the attacker rather than the owner. This issue affects ash_authentication: from 4.14.0 before 4.15.0 and from 5.0.0-rc.10 before 5.0.0-rc.14.