GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-88952 (GCVE-0-2026-88952)

Vulnerability from cvelistv5 – Published: 2026-09-17 14:15 – Updated: 2026-09-17 19:32
VLAI
Title
OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication
Summary
Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action's upsert_identity keys, then gates linking the incoming provider identity to it on email_trusted?/2, which reads only the provider's email_verified boolean and never compares the provider's email value with the matched account's email. That gate assumes the account was matched by its email field, so under any other upsert_identity it is vacuous and an attacker presenting their own verified email is attached to, and issued a session for, an account matched on some other attribute. The same unguarded gate applies in OAuth2.SignInPreparation on the registration_enabled? false path, where the account is matched by the sign-in action's read filter instead. The upsert also rewrites the matched account's email to the attacker's address, so later account recovery reaches the attacker rather than the owner. This issue affects ash_authentication: from 4.14.0 before 4.15.0 and from 5.0.0-rc.10 before 5.0.0-rc.14.
Severity
9.1 (Critical)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:32 UTC
CWE
  • CWE-287 - Improper Authentication
Assigner
References
Impacted products
Vendor Product Version CPE status
team-alembic ash_authentication Affected: 4.14.0 , < 4.15.0 (semver)
Affected: 5.0.0-rc.10 , < 5.0.0-rc.14 (semver)
    cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
Create a notification for this product.
team-alembic ash_authentication Affected: 64530644f9b37ebb76ca14aeb83a77597a0034b7 , < * (git)
Affected: 42edcd8ebb13fafbb168f12591d7518ce0611fec , < * (git)
    cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
James Harton James Harton James Harton Jonatan Männchen / EEF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-88952",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T19:32:22.090404Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T19:32:55.621Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Strategy.OAuth2.UserResolver\u0027",
            "\u0027Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation\u0027",
            "\u0027Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange\u0027",
            "\u0027Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange\u0027"
          ],
          "packageName": "ash_authentication",
          "packageURL": "pkg:hex/ash_authentication",
          "product": "ash_authentication",
          "programFiles": [
            "lib/ash_authentication/strategies/oauth2/user_resolver.ex",
            "lib/ash_authentication/strategies/oauth2/sign_in_preparation.ex",
            "lib/ash_authentication/strategies/oauth2/identity_change.ex",
            "lib/ash_authentication/strategies/dynamic_oidc/identity_change.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.OAuth2.UserResolver\u0027:resolve/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.OAuth2.UserResolver\u0027:email_trusted?/2"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation\u0027:prepare/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange\u0027:change/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange\u0027:change/3"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "4.15.0",
              "status": "affected",
              "version": "4.14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.0.0-rc.14",
              "status": "affected",
              "version": "5.0.0-rc.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Strategy.OAuth2.UserResolver\u0027",
            "\u0027Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation\u0027",
            "\u0027Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange\u0027",
            "\u0027Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange\u0027"
          ],
          "packageName": "team-alembic/ash_authentication",
          "packageURL": "pkg:github/team-alembic/ash_authentication",
          "product": "ash_authentication",
          "programFiles": [
            "lib/ash_authentication/strategies/oauth2/user_resolver.ex",
            "lib/ash_authentication/strategies/oauth2/sign_in_preparation.ex",
            "lib/ash_authentication/strategies/oauth2/identity_change.ex",
            "lib/ash_authentication/strategies/dynamic_oidc/identity_change.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.OAuth2.UserResolver\u0027:resolve/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.OAuth2.UserResolver\u0027:email_trusted?/2"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation\u0027:prepare/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange\u0027:change/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange\u0027:change/3"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "changes": [
                {
                  "at": "738bf9f32f2aa0d1bb92ce9ca5c2476cb5710459",
                  "status": "unaffected"
                },
                {
                  "at": "2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "64530644f9b37ebb76ca14aeb83a77597a0034b7",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "738bf9f32f2aa0d1bb92ce9ca5c2476cb5710459",
                  "status": "unaffected"
                },
                {
                  "at": "2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "42edcd8ebb13fafbb168f12591d7518ce0611fec",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe strategy must have \u003ccode\u003etrust_email_verified?\u003c/code\u003e enabled, and the account must be matched on something other than the email: a register action whose \u003ccode\u003eupsert_identity\u003c/code\u003e keys are not the email attribute, or, with \u003ccode\u003eregistration_enabled? false\u003c/code\u003e, a sign-in action whose read filter is not the email.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003etrust_email_verified?\u003c/code\u003e defaults to \u003ccode\u003efalse\u003c/code\u003e on the base \u003ccode\u003eoauth2\u003c/code\u003e strategy, but the \u003ccode\u003eapple\u003c/code\u003e, \u003ccode\u003eauth0\u003c/code\u003e, \u003ccode\u003egithub\u003c/code\u003e, \u003ccode\u003egoogle\u003c/code\u003e and \u003ccode\u003eslack\u003c/code\u003e strategies each set it to \u003ccode\u003etrue\u003c/code\u003e in their own DSL.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The strategy must have `trust_email_verified?` enabled, and the account must be matched on something other than the email: a register action whose `upsert_identity` keys are not the email attribute, or, with `registration_enabled? false`, a sign-in action whose read filter is not the email.\n\n`trust_email_verified?` defaults to `false` on the base `oauth2` strategy, but the `apple`, `auth0`, `github`, `google` and `slack` strategies each set it to `true` in their own DSL."
            }
          ],
          "value": "The strategy must have trust_email_verified? enabled, and the account must be matched on something other than the email: a register action whose upsert_identity keys are not the email attribute, or, with registration_enabled? false, a sign-in action whose read filter is not the email.\n\ntrust_email_verified? defaults to false on the base oauth2 strategy, but the apple, auth0, github, google and slack strategies each set it to true in their own DSL."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.15.0",
                  "versionStartIncluding": "4.14.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.0.0-rc.14",
                  "versionStartIncluding": "5.0.0-rc.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "James Harton"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "James Harton"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "James Harton"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-09-17T00:20:23.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAuthentication.Strategy.OAuth2.UserResolver.resolve/3\u003c/code\u003e matches an existing account using the register action\u0027s \u003ccode\u003eupsert_identity\u003c/code\u003e keys, then gates linking the incoming provider identity to it on \u003ccode\u003eemail_trusted?/2\u003c/code\u003e, which reads only the provider\u0027s \u003ccode\u003eemail_verified\u003c/code\u003e boolean and never compares the provider\u0027s email value with the matched account\u0027s email. That gate assumes the account was matched by its email field, so under any other \u003ccode\u003eupsert_identity\u003c/code\u003e it is vacuous and an attacker presenting their own verified email is attached to, and issued a session for, an account matched on some other attribute. The same unguarded gate applies in \u003ccode\u003eOAuth2.SignInPreparation\u003c/code\u003e on the \u003ccode\u003eregistration_enabled? false\u003c/code\u003e path, where the account is matched by the sign-in action\u0027s read filter instead. The upsert also rewrites the matched account\u0027s email to the attacker\u0027s address, so later account recovery reaches the attacker rather than the owner.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication: from 4.14.0 before 4.15.0 and from 5.0.0-rc.10 before 5.0.0-rc.14.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs.\n\n`AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3` matches an existing account using the register action\u0027s `upsert_identity` keys, then gates linking the incoming provider identity to it on `email_trusted?/2`, which reads only the provider\u0027s `email_verified` boolean and never compares the provider\u0027s email value with the matched account\u0027s email. That gate assumes the account was matched by its email field, so under any other `upsert_identity` it is vacuous and an attacker presenting their own verified email is attached to, and issued a session for, an account matched on some other attribute. The same unguarded gate applies in `OAuth2.SignInPreparation` on the `registration_enabled? false` path, where the account is matched by the sign-in action\u0027s read filter instead. The upsert also rewrites the matched account\u0027s email to the attacker\u0027s address, so later account recovery reaches the attacker rather than the owner.\n\nThis issue affects ash_authentication: from 4.14.0 before 4.15.0 and from 5.0.0-rc.10 before 5.0.0-rc.14."
            }
          ],
          "value": "Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs.\n\nAshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action\u0027s upsert_identity keys, then gates linking the incoming provider identity to it on email_trusted?/2, which reads only the provider\u0027s email_verified boolean and never compares the provider\u0027s email value with the matched account\u0027s email. That gate assumes the account was matched by its email field, so under any other upsert_identity it is vacuous and an attacker presenting their own verified email is attached to, and issued a session for, an account matched on some other attribute. The same unguarded gate applies in OAuth2.SignInPreparation on the registration_enabled? false path, where the account is matched by the sign-in action\u0027s read filter instead. The upsert also rewrites the matched account\u0027s email to the attacker\u0027s address, so later account recovery reaches the attacker rather than the owner.\n\nThis issue affects ash_authentication: from 4.14.0 before 4.15.0 and from 5.0.0-rc.10 before 5.0.0-rc.14."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn attacker who controls a provider account with a verified email of their own is signed in as a different local user, holding a session bearing that user\u0027s subject, with no interaction from the victim and no need to pre-register. Because the link also rewrites the matched account\u0027s email to the attacker\u0027s address, account recovery for the victim is redirected to the attacker and the compromise survives the provider identity being unlinked.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An attacker who controls a provider account with a verified email of their own is signed in as a different local user, holding a session bearing that user\u0027s subject, with no interaction from the victim and no need to pre-register. Because the link also rewrites the matched account\u0027s email to the attacker\u0027s address, account recovery for the victim is redirected to the attacker and the compromise survives the provider identity being unlinked."
                }
              ],
              "value": "An attacker who controls a provider account with a verified email of their own is signed in as a different local user, holding a session bearing that user\u0027s subject, with no interaction from the victim and no need to pre-register. Because the link also rewrites the matched account\u0027s email to the attacker\u0027s address, account recovery for the victim is redirected to the attacker and the compromise survives the provider identity being unlinked."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T14:15:19.506Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "GitHub Advisory",
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-wc6x-276q-jrf9"
        },
        {
          "name": "EEF CNA record for CVE-2026-88952",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-88952.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-88952",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-88952"
        },
        {
          "name": "Introducing commit 6453064 in team-alembic/ash_authentication",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/64530644f9b37ebb76ca14aeb83a77597a0034b7"
        },
        {
          "name": "Introducing commit 42edcd8 in team-alembic/ash_authentication",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/42edcd8ebb13fafbb168f12591d7518ce0611fec"
        },
        {
          "name": "Fix commit 738bf9f in team-alembic/ash_authentication",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/738bf9f32f2aa0d1bb92ce9ca5c2476cb5710459"
        },
        {
          "name": "Fix commit 2bd630e in team-alembic/ash_authentication",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrading prevents new links but does not unpick existing ones. An account already linked through this path stays linked, and a victim\u0027s email may already have been rewritten to the attacker\u0027s address.\u003c/p\u003e\n\u003cp\u003eOperators whose register action or sign-in action matched on anything other than the email should review their \u003ccode\u003eUserIdentity\u003c/code\u003e rows for links whose provider email does not match the linked account\u0027s email, and check affected accounts for a rewritten email address.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Upgrading prevents new links but does not unpick existing ones. An account already linked through this path stays linked, and a victim\u0027s email may already have been rewritten to the attacker\u0027s address.\n\nOperators whose register action or sign-in action matched on anything other than the email should review their `UserIdentity` rows for links whose provider email does not match the linked account\u0027s email, and check affected accounts for a rewritten email address."
            }
          ],
          "value": "Upgrading prevents new links but does not unpick existing ones. An account already linked through this path stays linked, and a victim\u0027s email may already have been rewritten to the attacker\u0027s address.\n\nOperators whose register action or sign-in action matched on anything other than the email should review their UserIdentity rows for links whose provider email does not match the linked account\u0027s email, and check affected accounts for a rewritten email address."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSet \u003ccode\u003etrust_email_verified? false\u003c/code\u003e on the affected strategy, which refuses the sign-in rather than linking it and closes both the register and the sign-in path.\u003c/p\u003e\n\u003cp\u003eAlternatively, key the register action\u0027s \u003ccode\u003eupsert_identity\u003c/code\u003e, or the sign-in action\u0027s read filter, on the email attribute, which restores the premise the gate assumes.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Set `trust_email_verified? false` on the affected strategy, which refuses the sign-in rather than linking it and closes both the register and the sign-in path.\n\nAlternatively, key the register action\u0027s `upsert_identity`, or the sign-in action\u0027s read filter, on the email attribute, which restores the premise the gate assumes."
            }
          ],
          "value": "Set trust_email_verified? false on the affected strategy, which refuses the sign-in rather than linking it and closes both the register and the sign-in path.\n\nAlternatively, key the register action\u0027s upsert_identity, or the sign-in action\u0027s read filter, on the email attribute, which restores the premise the gate assumes."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-88952",
    "datePublished": "2026-09-17T14:15:19.506Z",
    "dateReserved": "2026-09-16T10:30:02.169Z",
    "dateUpdated": "2026-09-17T19:32:55.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-88952\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-09-17T15:16:56.290\",\"lastModified\":\"2026-09-17T20:18:51.800\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs.\\n\\nAshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action\u0027s upsert_identity keys, then gates linking the incoming provider identity to it on email_trusted?/2, which reads only the provider\u0027s email_verified boolean and never compares the provider\u0027s email value with the matched account\u0027s email. That gate assumes the account was matched by its email field, so under any other upsert_identity it is vacuous and an attacker presenting their own verified email is attached to, and issued a session for, an account matched on some other attribute. The same unguarded gate applies in OAuth2.SignInPreparation on the registration_enabled? false path, where the account is matched by the sign-in action\u0027s read filter instead. The upsert also rewrites the matched account\u0027s email to the attacker\u0027s address, so later account recovery reaches the attacker rather than the owner.\\n\\nThis issue affects ash_authentication: from 4.14.0 before 4.15.0 and from 5.0.0-rc.10 before 5.0.0-rc.14.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"team-alembic\",\"product\":\"ash_authentication\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"ash_authentication\",\"cpes\":[\"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.AshAuthentication.Strategy.OAuth2.UserResolver\u0027\",\"\u0027Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation\u0027\",\"\u0027Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange\u0027\",\"\u0027Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange\u0027\"],\"programFiles\":[\"lib/ash_authentication/strategies/oauth2/user_resolver.ex\",\"lib/ash_authentication/strategies/oauth2/sign_in_preparation.ex\",\"lib/ash_authentication/strategies/oauth2/identity_change.ex\",\"lib/ash_authentication/strategies/dynamic_oidc/identity_change.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.AshAuthentication.Strategy.OAuth2.UserResolver\u0027:resolve/3\"},{\"name\":\"\u0027Elixir.AshAuthentication.Strategy.OAuth2.UserResolver\u0027:email_trusted?/2\"},{\"name\":\"\u0027Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation\u0027:prepare/3\"},{\"name\":\"\u0027Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange\u0027:change/3\"},{\"name\":\"\u0027Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange\u0027:change/3\"}],\"repo\":\"https://github.com/team-alembic/ash_authentication\",\"packageURL\":\"pkg:hex/ash_authentication\",\"versions\":[{\"version\":\"4.14.0\",\"lessThan\":\"4.15.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.0.0-rc.10\",\"lessThan\":\"5.0.0-rc.14\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"team-alembic\",\"product\":\"ash_authentication\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"team-alembic/ash_authentication\",\"cpes\":[\"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.AshAuthentication.Strategy.OAuth2.UserResolver\u0027\",\"\u0027Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation\u0027\",\"\u0027Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange\u0027\",\"\u0027Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange\u0027\"],\"programFiles\":[\"lib/ash_authentication/strategies/oauth2/user_resolver.ex\",\"lib/ash_authentication/strategies/oauth2/sign_in_preparation.ex\",\"lib/ash_authentication/strategies/oauth2/identity_change.ex\",\"lib/ash_authentication/strategies/dynamic_oidc/identity_change.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.AshAuthentication.Strategy.OAuth2.UserResolver\u0027:resolve/3\"},{\"name\":\"\u0027Elixir.AshAuthentication.Strategy.OAuth2.UserResolver\u0027:email_trusted?/2\"},{\"name\":\"\u0027Elixir.AshAuthentication.Strategy.OAuth2.SignInPreparation\u0027:prepare/3\"},{\"name\":\"\u0027Elixir.AshAuthentication.Strategy.OAuth2.IdentityChange\u0027:change/3\"},{\"name\":\"\u0027Elixir.AshAuthentication.Strategy.DynamicOidc.IdentityChange\u0027:change/3\"}],\"repo\":\"https://github.com/team-alembic/ash_authentication\",\"packageURL\":\"pkg:github/team-alembic/ash_authentication\",\"versions\":[{\"version\":\"64530644f9b37ebb76ca14aeb83a77597a0034b7\",\"lessThan\":\"*\",\"versionType\":\"git\",\"status\":\"affected\",\"changes\":[{\"at\":\"738bf9f32f2aa0d1bb92ce9ca5c2476cb5710459\",\"status\":\"unaffected\"},{\"at\":\"2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba\",\"status\":\"unaffected\"}]},{\"version\":\"42edcd8ebb13fafbb168f12591d7518ce0611fec\",\"lessThan\":\"*\",\"versionType\":\"git\",\"status\":\"affected\",\"changes\":[{\"at\":\"738bf9f32f2aa0d1bb92ce9ca5c2476cb5710459\",\"status\":\"unaffected\"},{\"at\":\"2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba\",\"status\":\"unaffected\"}]}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-17T19:32:22.090404Z\",\"id\":\"CVE-2026-88952\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-88952.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/team-alembic/ash_authentication/commit/2bd630eef8b7c8ae1e90e8fd43ba12fbc7e256ba\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/team-alembic/ash_authentication/commit/42edcd8ebb13fafbb168f12591d7518ce0611fec\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/team-alembic/ash_authentication/commit/64530644f9b37ebb76ca14aeb83a77597a0034b7\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/team-alembic/ash_authentication/commit/738bf9f32f2aa0d1bb92ce9ca5c2476cb5710459\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-wc6x-276q-jrf9\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-88952\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.