Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-85500: AshAuthentication lets unconfirmed users sign in
CVE-2026-85500 · published 24 days ago
Summary
The AshAuthentication library used in your system may let people log in without confirming their email address. This happens because the check that should block unverified accounts can be skipped or misread, especially when certain data fields are hidden or not loaded. Update the AshAuthentication package to the latest version or adjust the configuration to ensure email confirmation is always required before a session is created.
What to do
- Update team-alembic ash_authentication to version 1076639a9d40213088d110c79ba6735b8cc85b16.
- Update ash-project ash_authentication to version 5.0.0-rc.14.
- Update ash_authentication to version 5.0.0-rc.14.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | team-alembic | ash_authentication |
< 4.15.0 < * Fix: upgrade to 1076639a9d40213088d110c79ba6735b8cc85b16
|
| Hex | ash-project | ash_authentication |
>= 5.0.0-rc.0, < 5.0.0-rc.14 Fix: upgrade to 5.0.0-rc.14
|
| Hex | – | ash_authentication |
>= 5.0.0-rc.0, < 5.0.0-rc.14 Fix: upgrade to 5.0.0-rc.14
|
Original advisory text
`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement.
AshAuthentication.Strategy.Password.Actions.check_user/2 decides whether the attribute named by require_confirmed_with is set using a bare is_nil(Map.get(user, value)). When that attribute is not selected on the loaded record Map.get/2 returns %Ash.NotLoaded{}, and when a field policy denies it for the current actor it returns %Ash.ForbiddenField{}. Neither is nil, so the rejection branch is skipped and sign-i
require_confirmed_with is enforced in two places, and neither holds in every configuration. sign_in_with_token and register are checked only inside AshAuthentication.Strategy.Password.Actions, not on the action itself, so any caller that invokes the action directly skips the check. An API layer such as AshGraphql or AshJsonApi invokes the action directly, so this applies to the default configuration. Where a check does run it compares the confirmation attribute against nil. That attribute holds %Ash.NotLoaded{} or %Ash.ForbiddenField{} when it sets select_by_default?: false, when an API layer narrows the read's select, or when a field policy hides it from the sign-in actor. Neither struct is nil, so those configurations read every user as confirmed.
This issue affects ash_authentication: from 4.3.8 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
AshAuthentication.Strategy.Password.Actions.check_user/2 decides whether the attribute named by require_confirmed_with is set using a bare is_nil(Map.get(user, value)). When that attribute is not selected on the loaded record Map.get/2 returns %Ash.NotLoaded{}, and when a field policy denies it for the current actor it returns %Ash.ForbiddenField{}. Neither is nil, so the rejection branch is skipped and sign-i
require_confirmed_with is enforced in two places, and neither holds in every configuration. sign_in_with_token and register are checked only inside AshAuthentication.Strategy.Password.Actions, not on the action itself, so any caller that invokes the action directly skips the check. An API layer such as AshGraphql or AshJsonApi invokes the action directly, so this applies to the default configuration. Where a check does run it compares the confirmation attribute against nil. That attribute holds %Ash.NotLoaded{} or %Ash.ForbiddenField{} when it sets select_by_default?: false, when an API layer narrows the read's select, or when a field policy hides it from the sign-in actor. Neither struct is nil, so those configurations read every user as confirmed.
This issue affects ash_authentication: from 4.3.8 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
References
- https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-fc47...
- https://cna.erlef.org/cves/CVE-2026-85500.html
- https://osv.dev/vulnerability/EEF-CVE-2026-85500
- https://github.com/team-alembic/ash_authentication/commit/1076639a9d40213088d110...
- https://hex.pm/packages/ash_authentication Product
- https://github.com URL
- https://repo.hex.pm URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85500... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-85500 Vendor Advisory
- https://github.com/team-alembic/ash_authentication Product
- https://github.com/team-alembic/ash_authentication/commit/17f4c25a372d1778c9cc45...
- https://github.com/team-alembic/ash_authentication/commit/7d37bc6e4df6697b5813d2...
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-305Authentication Bypass by Primary Weakness
Timeline
Published17 Sep 2026
Updated11 Oct 2026
First seen17 Sep 2026
Sources
CVE-2026-85500 · NVD
CVE-2026-85500 · MITRE
EEF-CVE-2026-85500 · OSV
GHSA-fc47-6pgw-wh22 · GHSA
CVE-2026-85500 · OSV
Track software like this
Free during beta