CVE-2026-88952

OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

CVSS 4.0 9.1 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-88952

Published

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action's upsert_identity keys, then gates linking the incoming provider identity to it on email_trusted?/2, which reads only the provider's email_verified boolean and never compares the provider's email value with the matched account's email. That gate assumes the account was matched by its email field, so under any other upsert_identity it is vacuous and an attacker presenting their own verified email is attached to, and issued a session for, an account matched on some other attribute. The same unguarded gate applies in OAuth2.SignInPreparation on the registration_enabled? false path, where the account is matched by the sign-in action's read filter instead. The upsert also rewrites the matched account's email to the attacker's address, so later account recovery reaches the attacker rather than the owner. This issue affects ash_authentication: from 4.14.0 before 4.15.0 and from 5.0.0-rc.10 before 5.0.0-rc.14.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-88952

Published

ash_authentication

https://repo.hex.pm

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://repo.hex.pm",
                    "cpes": [
                        "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.AshAuthentication.Strategy.OAuth2.UserResolver'",
                        "'Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation'",
                        "'Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange'",
                        "'Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange'"
                    ],
                    "packageName": "ash_authentication",
                    "packageURL": "pkg:hex/ash_authentication",
                    "product": "ash_authentication",
                    "programFiles": [
                        "lib/ash_authentication/strategies/oauth2/user_resolver.ex",
                        "lib/ash_authentication/strategies/oauth2/sign_in_preparation.ex",
                        "lib/ash_authentication/strategies/oauth2/identity_change.ex",
                        "lib/ash_authentication/strategies/dynamic_oidc/identity_change.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.AshAuthentication.Strategy.OAuth2.UserResolver':resolve/3"
                        },
                        {
                            "name": "'Elixir.AshAuthentication.Strategy.OAuth2.UserResolver':email_trusted?/2"
                        },
                        {
                            "name": "'Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation':prepare/3"
                        },
                        {
                            "name": "'Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange':change/3"
                        },
                        {
                            "name": "'Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange':change/3"
                        }
                    ],
                    "repo": "https://github.com/team-alembic/ash_authentication",
                    "vendor": "team-alembic",
                    "versions": [
                        {
                            "lessThan": "4.15.0",
                            "status": "affected",
                            "version": "4.14.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "5.0.0-rc.14",
                            "status": "affected",
                            "version": "5.0.0-rc.10",
                            "versionType": "semver"
                        }
                    ]
                }

team-alembic/ash_authentication

https://github.com

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://github.com",
                    "cpes": [
                        "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.AshAuthentication.Strategy.OAuth2.UserResolver'",
                        "'Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation'",
                        "'Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange'",
                        "'Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange'"
                    ],
                    "packageName": "team-alembic/ash_authentication",
                    "packageURL": "pkg:github/team-alembic/ash_authentication",
                    "product": "ash_authentication",
                    "programFiles": [
                        "lib/ash_authentication/strategies/oauth2/user_resolver.ex",
                        "lib/ash_authentication/strategies/oauth2/sign_in_preparation.ex",
                        "lib/ash_authentication/strategies/oauth2/identity_change.ex",
                        "lib/ash_authentication/strategies/dynamic_oidc/identity_change.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.AshAuthentication.Strategy.OAuth2.UserResolver':resolve/3"
                        },
                        {
                            "name": "'Elixir.AshAuthentication.Strategy.OAuth2.UserResolver':email_trusted?/2"
                        },
                        {
                            "name": "'Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation':prepare/3"
                        },
                        {
                            "name": "'Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange':change/3"
                        },
                        {
                            "name": "'Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange':change/3"
                        }
                    ],
                    "repo": "https://github.com/team-alembic/ash_authentication",
                    "vendor": "team-alembic",
                    "versions": [
                        {
                            "changes": [
                                {
                                    "at": "738bf9f32f2aa0d1bb92ce9ca5c2476cb5710459",
                                    "status": "unaffected"
                                },
                                {
                                    "at": "2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThan": "*",
                            "status": "affected",
                            "version": "64530644f9b37ebb76ca14aeb83a77597a0034b7",
                            "versionType": "git"
                        },
                        {
                            "changes": [
                                {
                                    "at": "738bf9f32f2aa0d1bb92ce9ca5c2476cb5710459",
                                    "status": "unaffected"
                                },
                                {
                                    "at": "2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThan": "*",
                            "status": "affected",
                            "version": "42edcd8ebb13fafbb168f12591d7518ce0611fec",
                            "versionType": "git"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON