EUVD-2026-81479Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because the attacker needs a registered account; AC:H reflects needing the victim's specific record id plus the Confirmation add-on being configured; account takeover gives C:H/I:H, no availability impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
4DescriptionCVE.org
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record.
AshAuthentication.AddOn.Confirmation.ConfirmChange verifies the token's signature and its act claim, then applies the changes stored against that token to whichever record the changeset targets, never comparing the sub claim against changeset.data. An attacker who registers an account and changes their own email replays the resulting token against a victim's record id, writing in their own address with force_change_attributes/2 and stamping confirmed_at, after which an ordinary password reset yields the account. The library's own confirmation flow is unaffected, because AshAuthentication.AddOn.Confirmation.Actions.confirm/3 resolves sub to a user and targets that record.
This issue affects ash_authentication: from 0.5.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
AnalysisAI
An authenticated account-takeover primitive exists in the Elixir library AshAuthentication (ash_authentication) versions 0.5.0 through 4.14.x and 5.0.0-rc.0 through 5.0.0-rc.13: an attacker who can register their own account can replay the confirmation token generated for their own email change against a victim's record, causing the victim's address to be overwritten with the attacker's and confirmed_at to be stamped, after which a routine password reset hands over the account. Exploitation requires the application to use the Confirmation add-on with monitored fields (typically :email), the attacker's own registered account (authenticated, PR:L), and knowledge of the victim's record id (normally a UUID primary key); no action by the victim is required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the application to use AshAuthentication's Confirmation add-on with monitored fields (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine authenticated account-takeover primitive, not a high-CVSS-but-low-impact issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_authentication to 4.15.0 (for the 0.5.0-4.14.x line) or 5.0.0-rc.14 (for the 5.0.0 release-candidate line); vendor-released patched versions are confirmed and the fixes are visible in the referenced commits https://github.com/team-alembic/ash_authentication/commit/d7c15c21d39c009206e010cd67e2d86370fe7a28 and https://github.com/team-alembic/ash_authentication/commit/2a2396af131ab67e2f445b805fecce8e6ca86c0e, with supporting context in https://github.com/team-alembic/ash_authentication/commit/1d4bb00617aecae85c33f2ff5bc7e094c6449a6e. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Elixir applications using ash_authentication versions 0.5.0 through 4.14.x and 5.0.0-rc.0 through 5.0.0-rc.13, confirm whether the Confirmation add-on with monitored :email fields is enabled, and apply the vendor patch per the vendor advisory (Patch available per vendor advisory) or, if patching cannot be completed immediately, disable the Confirmation add-on/monitored-field email flow or restrict self-registration until the fix is deployed; also review authentication and mail-confirmation logs for anomalous email-change, confirmation-token replay, and password-reset sequences. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Authentication
View allAsh Authentication is an authentication framework for Elixir applications. Rated medium severity (CVSS 6.3), this vulner
Account takeover in team-alembic AshAuthentication (0.1.0 to <4.14.0 and 5.0.0-rc.0 to <5.0.0-rc.10) lets an unauthentic
Authentication bypass in the Elixir library ash_authentication lets an attacker who operates one federated identity-prov
Account takeover in AshAuthentication (Elixir/Ash) 4.14.0 through 4.14.x and 5.0.0-rc.10 through 5.0.0-rc.13 lets unauth
Unconfirmed accounts can obtain an authenticated session in the AshAuthentication Elixir library, defeating the mandator
Revoked sessions continue to be treated as fully authenticated on affected AshAuthentication and AshAuthentication Phoen
Reusing a leaked single-use magic-link token is possible in the Elixir library ash_authentication because its validity c
Denial of service in the AshAuthentication API-key sign-in strategy lets an unauthenticated, remote attacker exhaust ser
JWT token replay in AshAuthentication exposes any application using the stateless bearer-token path to full account take
Authentication bypass in the AshAuthentication library for Elixir/Ash lets an authenticated attacker who holds a valid s
Password sign-in in AshAuthentication Phoenix (ash_authentication_phoenix 1.7.0 to <2.17.4 and 3.0.0-rc.0 to <3.0.0-rc.1
AshAuthentication's token-revocation action accepts forged JWTs without verifying their signature, letting an unauthenti
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today