Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-88952: AshAuthentication OAuth2 login can hijack another user
CVE-2026-88952 · published 24 days ago
Summary
The AshAuthentication library used for sign‑in allows an attacker to link their own verified email address to someone else’s account, giving them access as that user. This happens because the code does not check that the email from the external provider matches the email on the existing account. Update to version 4.15.0 or later (or 5.0.0‑rc.14 or later) to fix the issue.
What to do
- Update team-alembic ash_authentication to version 2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba.
- Update ash-project ash_authentication to version 5.0.0-rc.14.
- Update ash_authentication to version 5.0.0-rc.14.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | team-alembic | ash_authentication |
< 4.15.0 < * Fix: upgrade to 2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba
|
| Hex | ash-project | ash_authentication |
>= 5.0.0-rc.10, < 5.0.0-rc.14 Fix: upgrade to 5.0.0-rc.14
|
| Hex | – | ash_authentication |
>= 5.0.0-rc.10, < 5.0.0-rc.14 Fix: upgrade to 5.0.0-rc.14
|
Original advisory text
OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication
Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs.
AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action's upsert_identity keys, then gates linking the incoming provider identity to it on email_trusted?/2, which reads only the provider's email_verified boolean and never compares the provider's email value with the matched account's email. That gate assumes the account was matched by its email field, so under any other upsert_identity it is vacuous and an attacker presenting their own verified email is attached to, and issued a session for, an account matched on some other attribute. The same unguarded gate applies in OAuth2.SignInPreparation on the registration_enabled? false path, where the account is matched by the sign-in action's read filter instead. The upsert also rewrites the matched account's email to the attacker's address, so later account recovery reaches the attacker rather than the owner.
This issue affects ash_authentication: from 4.14.0 before 4.15.0 and from 5.0.0-rc.10 before 5.0.0-rc.14.
AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action's upsert_identity keys, then gates linking the incoming provider identity to it on email_trusted?/2, which reads only the provider's email_verified boolean and never compares the provider's email value with the matched account's email. That gate assumes the account was matched by its email field, so under any other upsert_identity it is vacuous and an attacker presenting their own verified email is attached to, and issued a session for, an account matched on some other attribute. The same unguarded gate applies in OAuth2.SignInPreparation on the registration_enabled? false path, where the account is matched by the sign-in action's read filter instead. The upsert also rewrites the matched account's email to the attacker's address, so later account recovery reaches the attacker rather than the owner.
This issue affects ash_authentication: from 4.14.0 before 4.15.0 and from 5.0.0-rc.10 before 5.0.0-rc.14.
References
- https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-wc6x...
- https://cna.erlef.org/cves/CVE-2026-88952.html
- https://osv.dev/vulnerability/EEF-CVE-2026-88952
- https://github.com/team-alembic/ash_authentication/commit/42edcd8ebb13fafbb168f1...
- https://github.com/team-alembic/ash_authentication/commit/2bd630eef8b7c8ae1e90e8...
- https://hex.pm/packages/ash_authentication Product
- https://github.com URL
- https://repo.hex.pm URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88952... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-88952 Vendor Advisory
- https://github.com/team-alembic/ash_authentication Product
- https://github.com/team-alembic/ash_authentication/commit/64530644f9b37ebb76ca14...
- https://github.com/team-alembic/ash_authentication/commit/738bf9f32f2aa0d1bb92ce...
Severity
9.1
Critical
Type
CWE-287Improper Authentication
Timeline
Published17 Sep 2026
Updated11 Oct 2026
First seen17 Sep 2026
Sources
CVE-2026-88952 · NVD
CVE-2026-88952 · MITRE
EEF-CVE-2026-88952 · OSV
GHSA-wc6x-276q-jrf9 · GHSA
CVE-2026-88952 · OSV
Track software like this
Free during beta